Resubmissions

18-04-2024 05:10

240418-ftstmadc7v 10

18-04-2024 05:10

240418-ftrassdc7s 10

18-04-2024 05:10

240418-ftqn9sdc61 10

18-04-2024 05:10

240418-ftp3qsdc6z 10

18-04-2024 05:10

240418-ftprzaca38 10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-04-2024 13:46

General

  • Target

    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe

  • Size

    434KB

  • MD5

    fd3312938db4f099372ee8f6cd664d46

  • SHA1

    5fca27cf9c9ecaaffd1ee4ee7413bc4a36c59269

  • SHA256

    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64

  • SHA512

    d204112a5c6611c653f36cc67e69598209f70bfbfbfb0da2cb7333a287c6a28bb8a9331dfffcfb0465d77860917e0d5b903a637b0463e9b1b6d8fe6d577cca01

  • SSDEEP

    12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK95OTTsx/SA/WegYfdNbrqnum:rXh6XcBXo8TsL8Y8m4OTTySA/DrfdNbU

Score
10/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    "C:\Users\Admin\AppData\Local\Temp\1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3764
    • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
      "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
      2⤵
      • Executes dropped EXE
      PID:1328

Network

  • flag-us
    GET
    http://66.111.2.131/tor/status-vote/current/consensus
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    66.111.2.131:9030
    Request
    GET /tor/status-vote/current/consensus HTTP/1.0
    Host: 66.111.2.131
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:47:29 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sun, 14 Apr 2024 14:00:00 GMT
    Vary: X-Or-Diff-From-Consensus
  • flag-us
    DNS
    131.2.111.66.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    131.2.111.66.in-addr.arpa
    IN PTR
    Response
    131.2.111.66.in-addr.arpa
    IN PTR
    sergetorbsdorg
  • flag-us
    DNS
    time-a.nist.gov
    Remote address:
    8.8.8.8:53
    Request
    time-a.nist.gov
    IN A
    Response
    time-a.nist.gov
    IN CNAME
    time-a-g.nist.gov
    time-a-g.nist.gov
    IN A
    129.6.15.28
  • flag-us
    DNS
    77.147.196.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    77.147.196.217.in-addr.arpa
    IN PTR
    Response
    77.147.196.217.in-addr.arpa
    IN CNAME
    77.72-79.147.196.217.in-addr.arpa
    77.72-79.147.196.217.in-addr.arpa
    IN PTR
    tor cypherpunkseu
  • flag-us
    DNS
    41.219.218.216.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.219.218.216.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.182.3.50.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.182.3.50.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    11.218.163.103.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.218.163.103.in-addr.arpa
    IN PTR
    Response
    11.218.163.103.in-addr.arpa
    IN PTR
    zlisianthuscom
  • flag-us
    DNS
    api.ipify.org
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.12.205
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    172.67.74.152
  • flag-us
    DNS
    205.12.26.104.in-addr.arpa
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    8.8.8.8:53
    Request
    205.12.26.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.15.6.129.in-addr.arpa
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    8.8.8.8:53
    Request
    28.15.6.129.in-addr.arpa
    IN PTR
    Response
    28.15.6.129.in-addr.arpa
    IN PTR
    time-a-gnistgov
  • flag-us
    DNS
    66.123.5.64.in-addr.arpa
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    8.8.8.8:53
    Request
    66.123.5.64.in-addr.arpa
    IN PTR
    Response
    66.123.5.64.in-addr.arpa
    IN PTR
    tor66nullhostnet
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    GET
    https://api.ipify.org/
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    104.26.12.205:443
    Request
    GET / HTTP/1.0
    Host: api.ipify.org
    Response
    HTTP/1.1 200 OK
    Date: Sun, 14 Apr 2024 13:47:42 GMT
    Content-Type: text/plain
    Content-Length: 14
    Connection: close
    Vary: Origin
    CF-Cache-Status: DYNAMIC
    Server: cloudflare
    CF-RAY: 87442633cc4635da-LHR
  • flag-at
    GET
    http://217.196.147.77/tor/server/fp/8b7e9a8eb94e950daa2fe8082ecd722220b6c70f
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    217.196.147.77:80
    Request
    GET /tor/server/fp/8b7e9a8eb94e950daa2fe8082ecd722220b6c70f HTTP/1.0
    Host: 217.196.147.77
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:47:42 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:47:42 GMT
  • flag-at
    GET
    http://217.196.147.77/tor/server/fp/673abf8132785e24ce48606ad783fde9baa92964
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    217.196.147.77:80
    Request
    GET /tor/server/fp/673abf8132785e24ce48606ad783fde9baa92964 HTTP/1.0
    Host: 217.196.147.77
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:47:43 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:47:43 GMT
  • flag-us
    DNS
    166.250.128.174.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    166.250.128.174.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    11.35.66.45.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.35.66.45.in-addr.arpa
    IN PTR
    Response
    11.35.66.45.in-addr.arpa
    IN PTR
    tordizumcom
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
    Response
    nexusrules.officeapps.live.com
    IN CNAME
    prod.nexusrules.live.com.akadns.net
    prod.nexusrules.live.com.akadns.net
    IN A
    52.111.227.13
  • flag-at
    GET
    http://217.196.147.77/tor/server/fp/70aca07d9276277b82e909c1439e19cca2fb16cc
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    217.196.147.77:80
    Request
    GET /tor/server/fp/70aca07d9276277b82e909c1439e19cca2fb16cc HTTP/1.0
    Host: 217.196.147.77
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:47:43 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:47:43 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/f9797148240deac46debe55131d5191f92634912
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/f9797148240deac46debe55131d5191f92634912 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:47:45 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:47:45 GMT
  • flag-at
    GET
    http://217.196.147.77/tor/server/fp/f9860dedceb62b74a728b50ee374293ac48386da
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    217.196.147.77:80
    Request
    GET /tor/server/fp/f9860dedceb62b74a728b50ee374293ac48386da HTTP/1.0
    Host: 217.196.147.77
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:47:47 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:47:47 GMT
  • flag-nl
    GET
    http://45.66.35.11/tor/server/fp/f98a70e5427bff111640011f7ae31e537ecf1dd2
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    45.66.35.11:80
    Request
    GET /tor/server/fp/f98a70e5427bff111640011f7ae31e537ecf1dd2 HTTP/1.0
    Host: 45.66.35.11
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:47:49 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:47:49 GMT
  • flag-at
    GET
    http://217.196.147.77/tor/server/fp/767e444e1fa1da75f3b77479db5ae2fa3fff75cc
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    217.196.147.77:80
    Request
    GET /tor/server/fp/767e444e1fa1da75f3b77479db5ae2fa3fff75cc HTTP/1.0
    Host: 217.196.147.77
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:47:52 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:47:52 GMT
  • flag-at
    GET
    http://217.196.147.77/tor/server/fp/76959901386e8c908f50235d9894007886b67c2e
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    217.196.147.77:80
    Request
    GET /tor/server/fp/76959901386e8c908f50235d9894007886b67c2e HTTP/1.0
    Host: 217.196.147.77
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:47:56 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:47:56 GMT
  • flag-nl
    GET
    http://45.66.35.11/tor/server/fp/76c8b133363101b3c6c09daf0f395c53a9a0a7cf
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    45.66.35.11:80
    Request
    GET /tor/server/fp/76c8b133363101b3c6c09daf0f395c53a9a0a7cf HTTP/1.0
    Host: 45.66.35.11
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:47:57 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:47:57 GMT
  • flag-nl
    GET
    http://45.66.35.11/tor/server/fp/962843fbf8513f57e1190fd4c2ddf083a00c7867
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    45.66.35.11:80
    Request
    GET /tor/server/fp/962843fbf8513f57e1190fd4c2ddf083a00c7867 HTTP/1.0
    Host: 45.66.35.11
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:47:59 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:47:59 GMT
  • flag-at
    GET
    http://217.196.147.77/tor/server/fp/6afaff466f7bf61c6496d2e05aecd6b0e4de1eb7
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    217.196.147.77:80
    Request
    GET /tor/server/fp/6afaff466f7bf61c6496d2e05aecd6b0e4de1eb7 HTTP/1.0
    Host: 217.196.147.77
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:48:00 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:48:00 GMT
  • flag-at
    GET
    http://217.196.147.77/tor/server/fp/fe47caca53ba10081de464014db4c8fc0a1f8c5c
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    217.196.147.77:80
    Request
    GET /tor/server/fp/fe47caca53ba10081de464014db4c8fc0a1f8c5c HTTP/1.0
    Host: 217.196.147.77
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:48:01 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:48:01 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/1442f40ca33ac29441f54ef696fcc04a5a16c307
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/1442f40ca33ac29441f54ef696fcc04a5a16c307 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:48:28 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:48:28 GMT
  • flag-at
    GET
    http://217.196.147.77/tor/server/fp/c7c4528b3683e34a62a965785f7a22c4561864fe
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    217.196.147.77:80
    Request
    GET /tor/server/fp/c7c4528b3683e34a62a965785f7a22c4561864fe HTTP/1.0
    Host: 217.196.147.77
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:48:49 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:48:49 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/b319d987c712803523c87efe402efdb7a932103c
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/b319d987c712803523c87efe402efdb7a932103c HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:48:53 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:48:53 GMT
  • flag-at
    GET
    http://217.196.147.77/tor/server/fp/5d98a8a2f60f26c65e34f4205be77219e10efb09
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    217.196.147.77:80
    Request
    GET /tor/server/fp/5d98a8a2f60f26c65e34f4205be77219e10efb09 HTTP/1.0
    Host: 217.196.147.77
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:48:54 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:48:54 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/23e1eca2727d24a05b3407c0a686d0ba9d3d1a26
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/23e1eca2727d24a05b3407c0a686d0ba9d3d1a26 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:49:31 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:49:31 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/313621479c809a7a2dd2e8a601be96292046dc65
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/313621479c809a7a2dd2e8a601be96292046dc65 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:49:33 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:49:33 GMT
  • flag-at
    GET
    http://217.196.147.77/tor/server/fp/bbe7673d06ccdf2cab830d33d2af3e31a1dd7482
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    Remote address:
    217.196.147.77:80
    Request
    GET /tor/server/fp/bbe7673d06ccdf2cab830d33d2af3e31a1dd7482 HTTP/1.0
    Host: 217.196.147.77
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 13:49:34 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 13:49:34 GMT
  • 66.111.2.131:9030
    http://66.111.2.131/tor/status-vote/current/consensus
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    57.3kB
    3.3MB
    1241
    2412

    HTTP Request

    GET http://66.111.2.131/tor/status-vote/current/consensus

    HTTP Response

    200
  • 104.26.12.205:443
    https://api.ipify.org/
    tls, http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    856 B
    5.7kB
    11
    13

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 217.196.147.77:80
    http://217.196.147.77/tor/server/fp/8b7e9a8eb94e950daa2fe8082ecd722220b6c70f
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    417 B
    5.3kB
    7
    8

    HTTP Request

    GET http://217.196.147.77/tor/server/fp/8b7e9a8eb94e950daa2fe8082ecd722220b6c70f

    HTTP Response

    200
  • 174.128.250.166:443
    tls, https
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    22.3kB
    25.4kB
    57
    70
  • 129.6.15.28:13
    time-a.nist.gov
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    190 B
    223 B
    4
    4
  • 217.196.147.77:80
    http://217.196.147.77/tor/server/fp/673abf8132785e24ce48606ad783fde9baa92964
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    417 B
    6.2kB
    7
    8

    HTTP Request

    GET http://217.196.147.77/tor/server/fp/673abf8132785e24ce48606ad783fde9baa92964

    HTTP Response

    200
  • 217.196.147.77:80
    http://217.196.147.77/tor/server/fp/70aca07d9276277b82e909c1439e19cca2fb16cc
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    371 B
    4.8kB
    6
    7

    HTTP Request

    GET http://217.196.147.77/tor/server/fp/70aca07d9276277b82e909c1439e19cca2fb16cc

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/f9797148240deac46debe55131d5191f92634912
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    371 B
    2.7kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/f9797148240deac46debe55131d5191f92634912

    HTTP Response

    200
  • 217.196.147.77:80
    http://217.196.147.77/tor/server/fp/f9860dedceb62b74a728b50ee374293ac48386da
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    371 B
    2.7kB
    6
    6

    HTTP Request

    GET http://217.196.147.77/tor/server/fp/f9860dedceb62b74a728b50ee374293ac48386da

    HTTP Response

    200
  • 45.66.35.11:80
    http://45.66.35.11/tor/server/fp/f98a70e5427bff111640011f7ae31e537ecf1dd2
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    420 B
    2.9kB
    7
    6

    HTTP Request

    GET http://45.66.35.11/tor/server/fp/f98a70e5427bff111640011f7ae31e537ecf1dd2

    HTTP Response

    200
  • 217.196.147.77:80
    http://217.196.147.77/tor/server/fp/767e444e1fa1da75f3b77479db5ae2fa3fff75cc
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    371 B
    2.8kB
    6
    6

    HTTP Request

    GET http://217.196.147.77/tor/server/fp/767e444e1fa1da75f3b77479db5ae2fa3fff75cc

    HTTP Response

    200
  • 217.196.147.77:80
    http://217.196.147.77/tor/server/fp/76959901386e8c908f50235d9894007886b67c2e
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    371 B
    3.5kB
    6
    6

    HTTP Request

    GET http://217.196.147.77/tor/server/fp/76959901386e8c908f50235d9894007886b67c2e

    HTTP Response

    200
  • 45.66.35.11:80
    http://45.66.35.11/tor/server/fp/76c8b133363101b3c6c09daf0f395c53a9a0a7cf
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    368 B
    4.9kB
    6
    7

    HTTP Request

    GET http://45.66.35.11/tor/server/fp/76c8b133363101b3c6c09daf0f395c53a9a0a7cf

    HTTP Response

    200
  • 45.66.35.11:80
    http://45.66.35.11/tor/server/fp/962843fbf8513f57e1190fd4c2ddf083a00c7867
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    368 B
    4.1kB
    6
    7

    HTTP Request

    GET http://45.66.35.11/tor/server/fp/962843fbf8513f57e1190fd4c2ddf083a00c7867

    HTTP Response

    200
  • 64.5.123.66:443
    tls, https
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    21.4kB
    24.0kB
    49
    63
  • 217.196.147.77:80
    http://217.196.147.77/tor/server/fp/6afaff466f7bf61c6496d2e05aecd6b0e4de1eb7
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    371 B
    4.9kB
    6
    7

    HTTP Request

    GET http://217.196.147.77/tor/server/fp/6afaff466f7bf61c6496d2e05aecd6b0e4de1eb7

    HTTP Response

    200
  • 217.196.147.77:80
    http://217.196.147.77/tor/server/fp/fe47caca53ba10081de464014db4c8fc0a1f8c5c
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    509 B
    11.3kB
    9
    12

    HTTP Request

    GET http://217.196.147.77/tor/server/fp/fe47caca53ba10081de464014db4c8fc0a1f8c5c

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/1442f40ca33ac29441f54ef696fcc04a5a16c307
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    371 B
    2.7kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/1442f40ca33ac29441f54ef696fcc04a5a16c307

    HTTP Response

    200
  • 50.7.154.218:443
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    260 B
    5
  • 52.111.236.23:443
    322 B
    7
  • 217.196.147.77:80
    http://217.196.147.77/tor/server/fp/c7c4528b3683e34a62a965785f7a22c4561864fe
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    371 B
    3.8kB
    6
    7

    HTTP Request

    GET http://217.196.147.77/tor/server/fp/c7c4528b3683e34a62a965785f7a22c4561864fe

    HTTP Response

    200
  • 50.3.182.133:443
    tls, https
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    13.7kB
    16.4kB
    35
    49
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/b319d987c712803523c87efe402efdb7a932103c
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    371 B
    2.8kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/b319d987c712803523c87efe402efdb7a932103c

    HTTP Response

    200
  • 217.196.147.77:80
    http://217.196.147.77/tor/server/fp/5d98a8a2f60f26c65e34f4205be77219e10efb09
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    647 B
    20.2kB
    12
    18

    HTTP Request

    GET http://217.196.147.77/tor/server/fp/5d98a8a2f60f26c65e34f4205be77219e10efb09

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/23e1eca2727d24a05b3407c0a686d0ba9d3d1a26
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    371 B
    4.0kB
    6
    7

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/23e1eca2727d24a05b3407c0a686d0ba9d3d1a26

    HTTP Response

    200
  • 103.163.218.11:443
    tls, https
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    21.3kB
    22.5kB
    48
    65
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/313621479c809a7a2dd2e8a601be96292046dc65
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    371 B
    2.7kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/313621479c809a7a2dd2e8a601be96292046dc65

    HTTP Response

    200
  • 217.196.147.77:80
    http://217.196.147.77/tor/server/fp/bbe7673d06ccdf2cab830d33d2af3e31a1dd7482
    http
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    647 B
    20.9kB
    12
    19

    HTTP Request

    GET http://217.196.147.77/tor/server/fp/bbe7673d06ccdf2cab830d33d2af3e31a1dd7482

    HTTP Response

    200
  • 8.8.8.8:53
    131.2.111.66.in-addr.arpa
    dns
    422 B
    695 B
    6
    6

    DNS Request

    131.2.111.66.in-addr.arpa

    DNS Request

    time-a.nist.gov

    DNS Response

    129.6.15.28

    DNS Request

    77.147.196.217.in-addr.arpa

    DNS Request

    41.219.218.216.in-addr.arpa

    DNS Request

    133.182.3.50.in-addr.arpa

    DNS Request

    11.218.163.103.in-addr.arpa

  • 8.8.8.8:53
    api.ipify.org
    dns
    1734c05884e55ddb98494e1e5489f8e65e27e5752384eaeddb8adbdcc3788a64.exe
    343 B
    602 B
    5
    5

    DNS Request

    api.ipify.org

    DNS Response

    104.26.12.205
    104.26.13.205
    172.67.74.152

    DNS Request

    205.12.26.104.in-addr.arpa

    DNS Request

    28.15.6.129.in-addr.arpa

    DNS Request

    66.123.5.64.in-addr.arpa

    DNS Request

    13.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    166.250.128.174.in-addr.arpa
    dns
    220 B
    371 B
    3
    3

    DNS Request

    166.250.128.174.in-addr.arpa

    DNS Request

    11.35.66.45.in-addr.arpa

    DNS Request

    nexusrules.officeapps.live.com

    DNS Response

    52.111.227.13

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

    Filesize

    3KB

    MD5

    b4cd27f2b37665f51eb9fe685ec1d373

    SHA1

    7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

    SHA256

    91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

    SHA512

    e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

  • C:\Users\Admin\AppData\Local\Temp\x64btit.txt

    Filesize

    28B

    MD5

    2e0daedf70f8a6e208712f239956d840

    SHA1

    06a4fd788a17e41f622c9e200df00d11be731ba8

    SHA256

    0db253bd1bc61e7e74be9c32ed509cfec9e3f7eae4748a5913d58f7e7cfecf68

    SHA512

    95befd25c8b461c3c08230f9ff5114c45b5efc6cd4b78dde0a5741d5c61112561cfc97076eebdb9b83bb92a1f44b5475128c02554b65c989e2e5af960f919fdf

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.