Overview

overview

10

Static

static

10

injector.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    286s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2024, 18:04 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    injector.exe

  • Size

    45KB

  • MD5

    326de0250397bbb4dc3d6c59d86ff270

  • SHA1

    54c382e15430944fb2f989c674691154530cf70e

  • SHA256

    d9509675b5cc135df8819982448ee4713180c6f7c0fdc0c92af21200b5533039

  • SHA512

    29eec3172941cba583f48ac3051dd88195cd70f659b319f9fda9e4afd6780b402b9391c4750dd929c90bb0a775a5236cc3575927140a7dedbdeb2c62d3f18699

  • SSDEEP

    768:pdhO/poiiUcjlJInxCLue9H9Xqk5nWEZ5SbTDaJWI7CPW5J:nw+jjgn8ye9H9XqcnW85SbTgWIx

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

fn_external.exe

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    4444

  • startup_name

    fn_exrternal.exe

Signatures

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\injector.exe
    "C:\Users\Admin\AppData\Local\Temp\injector.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3192
    • C:\Users\Admin\AppData\Roaming\XenoManager\injector.exe
      "C:\Users\Admin\AppData\Roaming\XenoManager\injector.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1612
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN "fn_exrternal.exe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp809A.tmp" /F
        3⤵
        • Creates scheduled task(s)
        PID:1456
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff98b2fab58,0x7ff98b2fab68,0x7ff98b2fab78
      2⤵
        PID:3496
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:2
        2⤵
          PID:3708
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:8
          2⤵
            PID:2732
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2304 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:8
            2⤵
              PID:3436
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:1
              2⤵
                PID:4504
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:1
                2⤵
                  PID:3236
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3876 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:1
                  2⤵
                    PID:2680
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4404 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:8
                    2⤵
                      PID:2444
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:8
                      2⤵
                        PID:4664
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4548 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:8
                        2⤵
                          PID:2140
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4544 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:8
                          2⤵
                            PID:1660
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:8
                            2⤵
                              PID:4440
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:8
                              2⤵
                                PID:3416
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:8
                                2⤵
                                  PID:4972
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1988,i,12727097362715631243,7442794517153024392,131072 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4936
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                1⤵
                                  PID:3192

                                Network

                                • flag-us
                                  DNS
                                  82.90.14.23.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  82.90.14.23.in-addr.arpa
                                  IN PTR
                                  Response
                                  82.90.14.23.in-addr.arpa
                                  IN PTR
                                  a23-14-90-82deploystaticakamaitechnologiescom
                                • flag-us
                                  DNS
                                  241.154.82.20.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  241.154.82.20.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  g.bing.com
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  g.bing.com
                                  IN A
                                  Response
                                  g.bing.com
                                  IN CNAME
                                  g-bing-com.dual-a-0034.a-msedge.net
                                  g-bing-com.dual-a-0034.a-msedge.net
                                  IN CNAME
                                  dual-a-0034.a-msedge.net
                                  dual-a-0034.a-msedge.net
                                  IN A
                                  204.79.197.237
                                  dual-a-0034.a-msedge.net
                                  IN A
                                  13.107.21.237
                                • flag-us
                                  GET
                                  https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=18a25cb948bb4ab784cc7d05ba4fd265&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=
                                  Remote address:
                                  204.79.197.237:443
                                  Request
                                  GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=18a25cb948bb4ab784cc7d05ba4fd265&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid= HTTP/2.0
                                  host: g.bing.com
                                  accept-encoding: gzip, deflate
                                  user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                  Response
                                  HTTP/2.0 204
                                  cache-control: no-cache, must-revalidate
                                  pragma: no-cache
                                  expires: Fri, 01 Jan 1990 00:00:00 GMT
                                  set-cookie: MUID=201413EDB4216FD90F69078FB5066E45; domain=.bing.com; expires=Sat, 10-May-2025 18:04:45 GMT; path=/; SameSite=None; Secure; Priority=High;
                                  strict-transport-security: max-age=31536000; includeSubDomains; preload
                                  access-control-allow-origin: *
                                  x-cache: CONFIG_NOCACHE
                                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                  x-msedge-ref: Ref A: 5D85BFFC7E804F0FAEC12DA854B93639 Ref B: LON04EDGE0609 Ref C: 2024-04-15T18:04:45Z
                                  date: Mon, 15 Apr 2024 18:04:44 GMT
                                • flag-us
                                  GET
                                  https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=18a25cb948bb4ab784cc7d05ba4fd265&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=
                                  Remote address:
                                  204.79.197.237:443
                                  Request
                                  GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=18a25cb948bb4ab784cc7d05ba4fd265&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid= HTTP/2.0
                                  host: g.bing.com
                                  accept-encoding: gzip, deflate
                                  user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                  cookie: MUID=201413EDB4216FD90F69078FB5066E45
                                  Response
                                  HTTP/2.0 204
                                  cache-control: no-cache, must-revalidate
                                  pragma: no-cache
                                  expires: Fri, 01 Jan 1990 00:00:00 GMT
                                  set-cookie: MSPTC=F8kFNhXf44-4Dz617m-k8MsZ0Hb4B2OXkrZyRlVQZ1A; domain=.bing.com; expires=Sat, 10-May-2025 18:04:45 GMT; path=/; Partitioned; secure; SameSite=None
                                  strict-transport-security: max-age=31536000; includeSubDomains; preload
                                  access-control-allow-origin: *
                                  x-cache: CONFIG_NOCACHE
                                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                  x-msedge-ref: Ref A: ACD8837F94D44988B4D97CDC9A61ECC9 Ref B: LON04EDGE0609 Ref C: 2024-04-15T18:04:45Z
                                  date: Mon, 15 Apr 2024 18:04:44 GMT
                                • flag-us
                                  GET
                                  https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=18a25cb948bb4ab784cc7d05ba4fd265&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=
                                  Remote address:
                                  204.79.197.237:443
                                  Request
                                  GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=18a25cb948bb4ab784cc7d05ba4fd265&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid= HTTP/2.0
                                  host: g.bing.com
                                  accept-encoding: gzip, deflate
                                  user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                  cookie: MUID=201413EDB4216FD90F69078FB5066E45; MSPTC=F8kFNhXf44-4Dz617m-k8MsZ0Hb4B2OXkrZyRlVQZ1A
                                  Response
                                  HTTP/2.0 204
                                  cache-control: no-cache, must-revalidate
                                  pragma: no-cache
                                  expires: Fri, 01 Jan 1990 00:00:00 GMT
                                  strict-transport-security: max-age=31536000; includeSubDomains; preload
                                  access-control-allow-origin: *
                                  x-cache: CONFIG_NOCACHE
                                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                  x-msedge-ref: Ref A: 5F63D58A20B8400B9DC2D501DCF95043 Ref B: LON04EDGE0609 Ref C: 2024-04-15T18:04:45Z
                                  date: Mon, 15 Apr 2024 18:04:44 GMT
                                • flag-us
                                  DNS
                                  237.197.79.204.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  237.197.79.204.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  21.114.53.23.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  21.114.53.23.in-addr.arpa
                                  IN PTR
                                  Response
                                  21.114.53.23.in-addr.arpa
                                  IN PTR
                                  a23-53-114-21deploystaticakamaitechnologiescom
                                • flag-us
                                  DNS
                                  26.35.223.20.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  26.35.223.20.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  www.google.com
                                  chrome.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  www.google.com
                                  IN A
                                  Response
                                  www.google.com
                                  IN A
                                  142.250.178.4
                                • flag-us
                                  DNS
                                  99.201.58.216.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  99.201.58.216.in-addr.arpa
                                  IN PTR
                                  Response
                                  99.201.58.216.in-addr.arpa
                                  IN PTR
                                  lhr48s48-in-f31e100net
                                  99.201.58.216.in-addr.arpa
                                  IN PTR
                                  prg03s02-in-f3�G
                                  99.201.58.216.in-addr.arpa
                                  IN PTR
                                  prg03s02-in-f99�G
                                • flag-us
                                  DNS
                                  202.187.250.142.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  202.187.250.142.in-addr.arpa
                                  IN PTR
                                  Response
                                  202.187.250.142.in-addr.arpa
                                  IN PTR
                                  lhr25s33-in-f101e100net
                                • flag-us
                                  DNS
                                  4.178.250.142.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  4.178.250.142.in-addr.arpa
                                  IN PTR
                                  Response
                                  4.178.250.142.in-addr.arpa
                                  IN PTR
                                  lhr48s27-in-f41e100net
                                • flag-us
                                  DNS
                                  clients2.google.com
                                  chrome.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  clients2.google.com
                                  IN A
                                  Response
                                  clients2.google.com
                                  IN CNAME
                                  clients.l.google.com
                                  clients.l.google.com
                                  IN A
                                  172.217.16.238
                                • flag-us
                                  DNS
                                  238.16.217.172.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  238.16.217.172.in-addr.arpa
                                  IN PTR
                                  Response
                                  238.16.217.172.in-addr.arpa
                                  IN PTR
                                  mad08s04-in-f141e100net
                                  238.16.217.172.in-addr.arpa
                                  IN PTR
                                  lhr48s28-in-f14�I
                                • flag-us
                                  DNS
                                  50.23.12.20.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  50.23.12.20.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  206.23.85.13.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  206.23.85.13.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  134.71.91.104.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  134.71.91.104.in-addr.arpa
                                  IN PTR
                                  Response
                                  134.71.91.104.in-addr.arpa
                                  IN PTR
                                  a104-91-71-134deploystaticakamaitechnologiescom
                                • flag-us
                                  DNS
                                  89.90.14.23.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  89.90.14.23.in-addr.arpa
                                  IN PTR
                                  Response
                                  89.90.14.23.in-addr.arpa
                                  IN PTR
                                  a23-14-90-89deploystaticakamaitechnologiescom
                                • flag-us
                                  DNS
                                  19.229.111.52.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  19.229.111.52.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  73.90.14.23.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  73.90.14.23.in-addr.arpa
                                  IN PTR
                                  Response
                                  73.90.14.23.in-addr.arpa
                                  IN PTR
                                  a23-14-90-73deploystaticakamaitechnologiescom
                                • flag-us
                                  DNS
                                  226.162.46.104.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  226.162.46.104.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  beacons.gcp.gvt2.com
                                  chrome.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  beacons.gcp.gvt2.com
                                  IN A
                                  Response
                                  beacons.gcp.gvt2.com
                                  IN CNAME
                                  beacons-handoff.gcp.gvt2.com
                                  beacons-handoff.gcp.gvt2.com
                                  IN A
                                  192.178.49.163
                                • flag-us
                                  POST
                                  https://beacons.gcp.gvt2.com/domainreliability/upload
                                  chrome.exe
                                  Remote address:
                                  192.178.49.163:443
                                  Request
                                  POST /domainreliability/upload HTTP/2.0
                                  host: beacons.gcp.gvt2.com
                                  content-length: 274
                                  content-type: application/json; charset=utf-8
                                  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
                                  accept-encoding: gzip, deflate, br
                                  accept-language: en-US,en;q=0.9
                                • flag-us
                                  DNS
                                  163.49.178.192.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  163.49.178.192.in-addr.arpa
                                  IN PTR
                                  Response
                                  163.49.178.192.in-addr.arpa
                                  IN PTR
                                  phx19s05-in-f31e100net
                                • 204.79.197.237:443
                                  https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=18a25cb948bb4ab784cc7d05ba4fd265&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=
                                  tls, http2
                                  2.0kB
                                   9.2kB
                                   22
                                  18

                                  HTTP Request

                                  GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=18a25cb948bb4ab784cc7d05ba4fd265&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=

                                  HTTP Response

                                  204

                                  HTTP Request

                                  GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=18a25cb948bb4ab784cc7d05ba4fd265&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=

                                  HTTP Response

                                  204

                                  HTTP Request

                                  GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=18a25cb948bb4ab784cc7d05ba4fd265&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=

                                  HTTP Response

                                  204
                                • 127.0.0.1:4444
                                  injector.exe
                                • 142.250.178.4:443
                                  www.google.com
                                  tls
                                  chrome.exe
                                  953 B
                                   4.8kB
                                   8
                                  9
                                • 172.217.16.238:443
                                  clients2.google.com
                                  tls, http2
                                  chrome.exe
                                  1.1kB
                                   8.5kB
                                   12
                                  12
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 52.111.229.43:443
                                  322 B
                                   7
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 192.178.49.163:443
                                  https://beacons.gcp.gvt2.com/domainreliability/upload
                                  tls, http2
                                  chrome.exe
                                  2.1kB
                                   7.2kB
                                   18
                                  17

                                  HTTP Request

                                  POST https://beacons.gcp.gvt2.com/domainreliability/upload
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 127.0.0.1:4444
                                  injector.exe
                                • 8.8.8.8:53
                                  82.90.14.23.in-addr.arpa
                                  dns
                                  70 B
                                   133 B
                                   1
                                  1

                                  DNS Request

                                  82.90.14.23.in-addr.arpa

                                • 8.8.8.8:53
                                  241.154.82.20.in-addr.arpa
                                  dns
                                  72 B
                                   158 B
                                   1
                                  1

                                  DNS Request

                                  241.154.82.20.in-addr.arpa

                                • 8.8.8.8:53
                                  g.bing.com
                                  dns
                                  56 B
                                   151 B
                                   1
                                  1

                                  DNS Request

                                  g.bing.com

                                  DNS Response

                                  204.79.197.237
                                  13.107.21.237

                                • 8.8.8.8:53
                                  237.197.79.204.in-addr.arpa
                                  dns
                                  73 B
                                   143 B
                                   1
                                  1

                                  DNS Request

                                  237.197.79.204.in-addr.arpa

                                • 8.8.8.8:53
                                  21.114.53.23.in-addr.arpa
                                  dns
                                  71 B
                                   135 B
                                   1
                                  1

                                  DNS Request

                                  21.114.53.23.in-addr.arpa

                                • 8.8.8.8:53
                                  26.35.223.20.in-addr.arpa
                                  dns
                                  71 B
                                   157 B
                                   1
                                  1

                                  DNS Request

                                  26.35.223.20.in-addr.arpa

                                • 8.8.8.8:53
                                  www.google.com
                                  dns
                                  chrome.exe
                                  60 B
                                   76 B
                                   1
                                  1

                                  DNS Request

                                  www.google.com

                                  DNS Response

                                  142.250.178.4

                                • 142.250.178.4:443
                                  www.google.com
                                  https
                                  chrome.exe
                                  5.3kB
                                   139.5kB
                                   60
                                  118
                                • 8.8.8.8:53
                                  99.201.58.216.in-addr.arpa
                                  dns
                                  72 B
                                   169 B
                                   1
                                  1

                                  DNS Request

                                  99.201.58.216.in-addr.arpa

                                • 8.8.8.8:53
                                  202.187.250.142.in-addr.arpa
                                  dns
                                  74 B
                                   113 B
                                   1
                                  1

                                  DNS Request

                                  202.187.250.142.in-addr.arpa

                                • 8.8.8.8:53
                                  4.178.250.142.in-addr.arpa
                                  dns
                                  72 B
                                   110 B
                                   1
                                  1

                                  DNS Request

                                  4.178.250.142.in-addr.arpa

                                • 8.8.8.8:53
                                  clients2.google.com
                                  dns
                                  chrome.exe
                                  65 B
                                   105 B
                                   1
                                  1

                                  DNS Request

                                  clients2.google.com

                                  DNS Response

                                  172.217.16.238

                                • 172.217.16.238:443
                                  clients2.google.com
                                  https
                                  chrome.exe
                                  3.7kB
                                   8.1kB
                                   11
                                  12
                                • 224.0.0.251:5353
                                  chrome.exe
                                  204 B
                                   3
                                • 8.8.8.8:53
                                  238.16.217.172.in-addr.arpa
                                  dns
                                  73 B
                                   142 B
                                   1
                                  1

                                  DNS Request

                                  238.16.217.172.in-addr.arpa

                                • 8.8.8.8:53
                                  50.23.12.20.in-addr.arpa
                                  dns
                                  70 B
                                   156 B
                                   1
                                  1

                                  DNS Request

                                  50.23.12.20.in-addr.arpa

                                • 8.8.8.8:53
                                  206.23.85.13.in-addr.arpa
                                  dns
                                  71 B
                                   145 B
                                   1
                                  1

                                  DNS Request

                                  206.23.85.13.in-addr.arpa

                                • 8.8.8.8:53
                                  134.71.91.104.in-addr.arpa
                                  dns
                                  72 B
                                   137 B
                                   1
                                  1

                                  DNS Request

                                  134.71.91.104.in-addr.arpa

                                • 8.8.8.8:53
                                  89.90.14.23.in-addr.arpa
                                  dns
                                  70 B
                                   133 B
                                   1
                                  1

                                  DNS Request

                                  89.90.14.23.in-addr.arpa

                                • 8.8.8.8:53
                                  19.229.111.52.in-addr.arpa
                                  dns
                                  72 B
                                   158 B
                                   1
                                  1

                                  DNS Request

                                  19.229.111.52.in-addr.arpa

                                • 8.8.8.8:53
                                  73.90.14.23.in-addr.arpa
                                  dns
                                  70 B
                                   133 B
                                   1
                                  1

                                  DNS Request

                                  73.90.14.23.in-addr.arpa

                                • 8.8.8.8:53
                                  226.162.46.104.in-addr.arpa
                                  dns
                                  73 B
                                   147 B
                                   1
                                  1

                                  DNS Request

                                  226.162.46.104.in-addr.arpa

                                • 8.8.8.8:53
                                  beacons.gcp.gvt2.com
                                  dns
                                  chrome.exe
                                  66 B
                                   112 B
                                   1
                                  1

                                  DNS Request

                                  beacons.gcp.gvt2.com

                                  DNS Response

                                  192.178.49.163

                                • 8.8.8.8:53
                                  163.49.178.192.in-addr.arpa
                                  dns
                                  73 B
                                   111 B
                                   1
                                  1

                                  DNS Request

                                  163.49.178.192.in-addr.arpa

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                  Filesize

                                  1KB

                                  MD5

                                  9710522f1ef2e31ddc03f99eb50f7805

                                  SHA1

                                  5a077c7e0493e4a11fe4054dd8e43f85d4b1bb87

                                  SHA256

                                  372d365729bc72cb6f54e8f5e18ea472390c7c28b60f3692017f71c6d3417e9c

                                  SHA512

                                  f1c79b9203b78b0479f0e6ae340de51e80219adbae444967cc31e17d3595d947f0f6d555f8be689fd4f54e51384c6a403940b2c54662aab51807939f146b555a

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                  Filesize

                                  1KB

                                  MD5

                                  498cc01e0cdaf11aac03f6bf4f12832e

                                  SHA1

                                  8695ad9224a1f54127ac10ae5f448249158d8a49

                                  SHA256

                                  1cb92d89dd38bd5dff22c63dc25b377e398076766d55eb0404abfd9976bc2392

                                  SHA512

                                  0c6ec6c7938ef27b3213d6e4f8385082a199bed1cd5dc006e94ba897b436798ec2d651fb23c6388758505522117b06660be72b3ad6aef27d67725fa5e140ba52

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                  Filesize

                                  2B

                                  MD5

                                  d751713988987e9331980363e24189ce

                                  SHA1

                                  97d170e1550eee4afc0af065b78cda302a97674c

                                  SHA256

                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                  SHA512

                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                  Filesize

                                  354B

                                  MD5

                                  8957a74002f8e45540def188ab914c81

                                  SHA1

                                  6dd1c0b729109bb2953613539b1c367c86ebd756

                                  SHA256

                                  8a58be15bfcab214c83685c7473ea6da9aa8e1b29ddc8bf15cc6de9800d9d289

                                  SHA512

                                  d862e9f3642c13c5aee65afa7df56e332951c7c90f1bc2d1a60f6905a9976219333b05edfe9d76ec1c62c64b535e0aac6fcfcd5fe1b4968f6dea9dade4d44771

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                  Filesize

                                  6KB

                                  MD5

                                  e7f9fc8ae20492b3c56f2720a5be65a1

                                  SHA1

                                  9d229b6afd238ab54469205f1191981e344c1fc0

                                  SHA256

                                  590a3c7c684d0af5e3886750fce5e0c69a9febc003fc4a5811d927addc7d985b

                                  SHA512

                                  163657fc1209119ea69ea9a0eb321b866dd6a723e92ae3f49637f032b47abaeef741d5abc41a4ab273236cf281eac0c4423a5c8b34ad9f1978c97110a1beeaad

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                  Filesize

                                  16KB

                                  MD5

                                  c33f5809a0690f1408162ab8de3536f7

                                  SHA1

                                  4be93dcd92c47d05fbaaf2d092ca09f28812cea8

                                  SHA256

                                  384dce050800a8f96161bf8a5e7767b0db6b58b711cc2a5c9e3513235ca58d74

                                  SHA512

                                  eeab27625641eee18e2302e113ba18c661a3296acad68f73a731bf53a159d3386cbca77058d1819b2a329dc0732f2f74adb91ed779e291ddf1d620b53983a447

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                  Filesize

                                  251KB

                                  MD5

                                  fbe3792cc6d9312b04dc22c66ffd2f33

                                  SHA1

                                  46c31b605a7e68e5e24eec0883ae26ed2e67ca4a

                                  SHA256

                                  8319f2e2491a021d4add3d889226bd3111a241966100bccb4e88dd7f5ef30831

                                  SHA512

                                  96ec3738c909f7023df3164a5f858194b4c9fd75691852aea18ed436527cdd122d8be5acb9227f8f2402231536f00afa661885250ae6e8a1ed21904f0b038286

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\injector.exe.log
                                  Filesize

                                  226B

                                  MD5

                                  916851e072fbabc4796d8916c5131092

                                  SHA1

                                  d48a602229a690c512d5fdaf4c8d77547a88e7a2

                                  SHA256

                                  7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                                  SHA512

                                  07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\tmp809A.tmp
                                  Filesize

                                  1KB

                                  MD5

                                  26838d37f8c1cb547c3600719743a907

                                  SHA1

                                  77fd3d5955e3639afb87acb94ed19fd03965f740

                                  SHA256

                                  6a5f2167680f5eae028b4678581ea6b6582a253f1944489bc8da72a78f5672aa

                                  SHA512

                                  a1de605dfe109209dcd7d37c5e79b9c6f101c438f25eea726a8d2edba27f09329ac81217f3f2f3f3cf38feac6d57a4fa78a2ba1f3f46310054299728270a2820

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\XenoManager\injector.exe
                                  Filesize

                                  45KB

                                  MD5

                                  326de0250397bbb4dc3d6c59d86ff270

                                  SHA1

                                  54c382e15430944fb2f989c674691154530cf70e

                                  SHA256

                                  d9509675b5cc135df8819982448ee4713180c6f7c0fdc0c92af21200b5533039

                                  SHA512

                                  29eec3172941cba583f48ac3051dd88195cd70f659b319f9fda9e4afd6780b402b9391c4750dd929c90bb0a775a5236cc3575927140a7dedbdeb2c62d3f18699

                                  Download Submit

                                • memory/1612-64-0x0000000074960000-0x0000000075110000-memory.dmp

                                  Filesize

                                  7.7MB

                                  Download

                                • memory/1612-65-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/1612-17-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/1612-16-0x0000000074960000-0x0000000075110000-memory.dmp

                                  Filesize

                                  7.7MB

                                  Download

                                • memory/3192-0-0x0000000000FF0000-0x0000000001002000-memory.dmp

                                  Filesize

                                  72KB

                                  Download

                                • memory/3192-15-0x0000000074960000-0x0000000075110000-memory.dmp

                                  Filesize

                                  7.7MB

                                  Download

                                • memory/3192-1-0x0000000074960000-0x0000000075110000-memory.dmp

                                  Filesize

                                  7.7MB

                                  Download

                                We care about your privacy.

                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.