Overview

overview

8

Static

static

3

DeepwokenM....4.exe

windows7-x64

8

DeepwokenM....4.exe

windows10-2004-x64

7

DeepwokenM...er.exe

windows7-x64

7

DeepwokenM...er.exe

windows10-2004-x64

7

DeepwokenM...ME.txt

windows7-x64

1

DeepwokenM...ME.txt

windows10-2004-x64

1

DeepwokenM...ox.dll

windows7-x64

1

DeepwokenM...ox.dll

windows10-2004-x64

1

DeepwokenM...ns.dll

windows7-x64

1

DeepwokenM...ns.dll

windows10-2004-x64

1

DeepwokenM...on.dll

windows7-x64

1

DeepwokenM...on.dll

windows10-2004-x64

1

DeepwokenM...UI.dll

windows7-x64

1

DeepwokenM...UI.dll

windows10-2004-x64

1

DeepwokenM...le.dll

windows7-x64

1

DeepwokenM...le.dll

windows10-2004-x64

1

DeepwokenM...ty.dll

windows7-x64

1

DeepwokenM...ty.dll

windows10-2004-x64

1

DeepwokenM...rk.dll

windows7-x64

1

DeepwokenM...rk.dll

windows10-2004-x64

1

DeepwokenM...ir.png

windows7-x64

3

DeepwokenM...ir.png

windows10-2004-x64

3

DeepwokenM...ua.xml

windows7-x64

1

DeepwokenM...ua.xml

windows10-2004-x64

1

DeepwokenM...AP.txt

windows7-x64

1

DeepwokenM...AP.txt

windows10-2004-x64

1

DeepwokenM...gs.txt

windows7-x64

1

DeepwokenM...gs.txt

windows10-2004-x64

1

DeepwokenM...VH.txt

windows7-x64

1

DeepwokenM...VH.txt

windows10-2004-x64

1

Resubmissions

18/04/2024, 09:57 UTC

240418-lzcx9ahg47 7

18/04/2024, 09:53 UTC

240418-lwy2baah9w 8

Analysis

  • max time kernel
    124s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 09:53 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DeepwokenMaster/Bloxstrap-v2.5.4.exe

  • Size

    7.6MB

  • MD5

    dbb820772caf0003967ef0f269fbdeb1

  • SHA1

    31992bd4977a7dfeba67537a2da6c9ca64bc304c

  • SHA256

    b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc

  • SHA512

    e8ac879c7198dffb78bc6ee4ad49b5de40a5a7dbbda53d427d0a034941487d13c8bb2b8d590a1fcdd81cd6abb8f21fdfcd52924eb00c45a42ee06c1e4b3d590f

  • SSDEEP

    98304:XNd5DSd5DxTsed5D2ZT00UuOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTl1:X+sdtObAbN0u

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DeepwokenMaster\Bloxstrap-v2.5.4.exe
    "C:\Users\Admin\AppData\Local\Temp\DeepwokenMaster\Bloxstrap-v2.5.4.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    PID:4536

Network

  • flag-us
    DNS
    73.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    18.24.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.24.18.2.in-addr.arpa
    IN PTR
    Response
    18.24.18.2.in-addr.arpa
    IN PTR
    a2-18-24-18deploystaticakamaitechnologiescom
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239362113785_1BQQBFJAZTSP82CQ9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239362113785_1BQQBFJAZTSP82CQ9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 700590
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 863A2739FC5C4A9697CCFD631B0DFCFF Ref B: LON04EDGE0906 Ref C: 2024-04-18T09:55:25Z
    date: Thu, 18 Apr 2024 09:55:24 GMT
  • flag-us
    DNS
    28.143.109.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.143.109.104.in-addr.arpa
    IN PTR
    Response
    28.143.109.104.in-addr.arpa
    IN PTR
    a104-109-143-28deploystaticakamaitechnologiescom
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=38B2A398DB8962E01DCCB7FDDA696329; domain=.bing.com; expires=Tue, 13-May-2025 09:55:34 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: A46E63775F2449839CBA41961C40BDAB Ref B: LON04EDGE1111 Ref C: 2024-04-18T09:55:34Z
    date: Thu, 18 Apr 2024 09:55:34 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=38B2A398DB8962E01DCCB7FDDA696329
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=JcXOr9Ws65ak9rRfvJ7vbhjiyxe09kZ-SyUeyqdj-UM; domain=.bing.com; expires=Tue, 13-May-2025 09:55:34 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 9AA5A286E7D54A4D87289511BBC8C0C7 Ref B: LON04EDGE1111 Ref C: 2024-04-18T09:55:34Z
    date: Thu, 18 Apr 2024 09:55:34 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=38B2A398DB8962E01DCCB7FDDA696329; MSPTC=JcXOr9Ws65ak9rRfvJ7vbhjiyxe09kZ-SyUeyqdj-UM
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 1B555CCBACFF48409BFAB9801041AB6E Ref B: LON04EDGE1111 Ref C: 2024-04-18T09:55:34Z
    date: Thu, 18 Apr 2024 09:55:34 GMT
  • flag-us
    DNS
    21.114.53.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.114.53.23.in-addr.arpa
    IN PTR
    Response
    21.114.53.23.in-addr.arpa
    IN PTR
    a23-53-114-21deploystaticakamaitechnologiescom
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.173.189.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239362113785_1BQQBFJAZTSP82CQ9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    27.1kB
     732.7kB
     543
    541

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239362113785_1BQQBFJAZTSP82CQ9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=
    tls, http2
    2.0kB
     9.2kB
     22
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=

    HTTP Response

    204
  • 8.8.8.8:53
    73.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    73.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    18.24.18.2.in-addr.arpa
    dns
    69 B
     131 B
     1
    1

    DNS Request

    18.24.18.2.in-addr.arpa

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.154.82.20.in-addr.arpa

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    28.143.109.104.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    28.143.109.104.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    21.114.53.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    21.114.53.23.in-addr.arpa

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    2.173.189.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.173.189.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4536-0-0x00007FFE6F390000-0x00007FFE6F88E000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/4536-1-0x00007FFE6F390000-0x00007FFE6F88E000-memory.dmp

    Filesize

    5.0MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.