Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
23/04/2024, 01:18 UTC
General
-
Target
a8af525b1e7409339ad8b6536e9cfd4dd7e8aea80ce8c944e9b9890985b448b4.exe
-
Size
1.8MB
-
MD5
35ce92e69f299076d54ea86ecdac571a
-
SHA1
46f6e4d56cbb8ec7ee66ce7e36c9cff0929e8b59
-
SHA256
a8af525b1e7409339ad8b6536e9cfd4dd7e8aea80ce8c944e9b9890985b448b4
-
SHA512
96a6d96258254bd55f3465daed3da532aab84703c7c320a45a1af80afc22b8c0db0b13dd909447d1a9f83c0c1dc498a11da4a2ff59329ec12fb6a76282111992
-
SSDEEP
49152:lx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WA8Dmg27RnWGj:lvbjVkjjCAzJJD527BWG
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8af525b1e7409339ad8b6536e9cfd4dd7e8aea80ce8c944e9b9890985b448b4.exe"C:\Users\Admin\AppData\Local\Temp\a8af525b1e7409339ad8b6536e9cfd4dd7e8aea80ce8c944e9b9890985b448b4.exe"1⤵
- Drops file in Program Files directory
Network
-
DNS76.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse -
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
DNS205.47.74.20.in-addr.arpaRemote address:8.8.8.8:53Request205.47.74.20.in-addr.arpaIN PTRResponse
-
DNS156.33.209.4.in-addr.arpaRemote address:8.8.8.8:53Request156.33.209.4.in-addr.arpaIN PTRResponse
-
DNS9.228.82.20.in-addr.arpaRemote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
DNS26.165.165.52.in-addr.arpaRemote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
DNS21.114.53.23.in-addr.arpaRemote address:8.8.8.8:53Request21.114.53.23.in-addr.arpaIN PTRResponse21.114.53.23.in-addr.arpaIN PTRa23-53-114-21deploystaticakamaitechnologiescom
-
DNS79.121.231.20.in-addr.arpaRemote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTRResponse
-
DNS79.121.231.20.in-addr.arpaRemote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTR
-
DNS79.121.231.20.in-addr.arpaRemote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTR
-
DNS206.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
DNS154.173.246.72.in-addr.arpaRemote address:8.8.8.8:53Request154.173.246.72.in-addr.arpaIN PTRResponse154.173.246.72.in-addr.arpaIN PTRa72-246-173-154deploystaticakamaitechnologiescom
-
DNS67.32.209.4.in-addr.arpaRemote address:8.8.8.8:53Request67.32.209.4.in-addr.arpaIN PTRResponse
-
DNS119.110.54.20.in-addr.arpaRemote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
DNS65.139.73.23.in-addr.arpaRemote address:8.8.8.8:53Request65.139.73.23.in-addr.arpaIN PTRResponse65.139.73.23.in-addr.arpaIN PTRa23-73-139-65deploystaticakamaitechnologiescom
-
DNS240.197.17.2.in-addr.arpaRemote address:8.8.8.8:53Request240.197.17.2.in-addr.arpaIN PTRResponse240.197.17.2.in-addr.arpaIN PTRa2-17-197-240deploystaticakamaitechnologiescom
-
DNS14.251.17.2.in-addr.arpaRemote address:8.8.8.8:53Request14.251.17.2.in-addr.arpaIN PTRResponse14.251.17.2.in-addr.arpaIN PTRa2-17-251-14deploystaticakamaitechnologiescom
-
DNS14.251.17.2.in-addr.arpaRemote address:8.8.8.8:53Request14.251.17.2.in-addr.arpaIN PTR
-
DNStse1.mm.bing.netRemote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317300970_1WZNZYNWWAF6IP05J&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317300970_1WZNZYNWWAF6IP05J&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 569199
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 032D6C685A544185BA5C648A65CCBA10 Ref B: LON04EDGE1118 Ref C: 2024-04-23T01:20:10Z
date: Tue, 23 Apr 2024 01:20:09 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301403_18A51FWD0ORQI7TWA&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301403_18A51FWD0ORQI7TWA&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 771044
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6EF6FF9389B04212BAB009D34E216299 Ref B: LON04EDGE1118 Ref C: 2024-04-23T01:20:10Z
date: Tue, 23 Apr 2024 01:20:09 GMT
-
DNS200.197.79.204.in-addr.arpaRemote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
DNS10.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request10.173.189.20.in-addr.arpaIN PTRResponse
-
DNS10.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request10.173.189.20.in-addr.arpaIN PTRResponse
-
138.91.171.81:80
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301403_18A51FWD0ORQI7TWA&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http2
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317300970_1WZNZYNWWAF6IP05J&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301403_18A51FWD0ORQI7TWA&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200HTTP Response
200
-
8.8.8.8:5376.32.126.40.in-addr.arpadns
DNS Request
76.32.126.40.in-addr.arpa
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:53205.47.74.20.in-addr.arpadns
DNS Request
205.47.74.20.in-addr.arpa
-
8.8.8.8:53156.33.209.4.in-addr.arpadns
DNS Request
156.33.209.4.in-addr.arpa
-
8.8.8.8:539.228.82.20.in-addr.arpadns
DNS Request
9.228.82.20.in-addr.arpa
-
8.8.8.8:5326.165.165.52.in-addr.arpadns
DNS Request
26.165.165.52.in-addr.arpa
-
8.8.8.8:5321.114.53.23.in-addr.arpadns
DNS Request
21.114.53.23.in-addr.arpa
-
8.8.8.8:5379.121.231.20.in-addr.arpadns
DNS Request
79.121.231.20.in-addr.arpa
DNS Request
79.121.231.20.in-addr.arpa
DNS Request
79.121.231.20.in-addr.arpa
-
8.8.8.8:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:53154.173.246.72.in-addr.arpadns
DNS Request
154.173.246.72.in-addr.arpa
-
8.8.8.8:5367.32.209.4.in-addr.arpadns
DNS Request
67.32.209.4.in-addr.arpa
-
8.8.8.8:53119.110.54.20.in-addr.arpadns
DNS Request
119.110.54.20.in-addr.arpa
-
8.8.8.8:5365.139.73.23.in-addr.arpadns
DNS Request
65.139.73.23.in-addr.arpa
-
8.8.8.8:53240.197.17.2.in-addr.arpadns
DNS Request
240.197.17.2.in-addr.arpa
-
8.8.8.8:5314.251.17.2.in-addr.arpadns
DNS Request
14.251.17.2.in-addr.arpa
DNS Request
14.251.17.2.in-addr.arpa
-
8.8.8.8:53tse1.mm.bing.netdns
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
8.8.8.8:53200.197.79.204.in-addr.arpadns
DNS Request
200.197.79.204.in-addr.arpa
-
8.8.8.8:5310.173.189.20.in-addr.arpadns
DNS Request
10.173.189.20.in-addr.arpa
DNS Request
10.173.189.20.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
-
Filesize
1.8MB