Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y... -.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of y...py.exe

windows10-1703-x64

10

a ton of ya/ya.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    1785s
  • max time network
    1790s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/05/2024, 02:16 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a ton of ya/ya.exe

  • Size

    63KB

  • MD5

    222c2d239f4c8a1d73c736c9cc712807

  • SHA1

    c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c

  • SHA256

    ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d

  • SHA512

    1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02

  • SSDEEP

    1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:23638

209.25.140.1:5525:23638

bring-recorder.gl.at.ply.gg:23638

action-yesterday.gl.at.ply.gg:23638

147.185.221.19:23638

then-wheel.gl.at.ply.gg::23638

then-wheel.gl.at.ply.gg:23638

teen-modes.gl.at.ply.gg:23638
Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    uwumonster.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Drops startup file 2 IoCs
  • Executes dropped EXE 30 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya.exe
    "C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "uwumonster" /tr "C:\Users\Admin\AppData\Local\uwumonster.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2916
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1588
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2684
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1000
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2024
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3240
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:788
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:192
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2972
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2388
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3484
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4680
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4196
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3240
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2268
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:208
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1400
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2492
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3548
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1872
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2024
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2180
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4004
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3396
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4808
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4732
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3056
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1392
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1848
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1604
  • C:\Users\Admin\AppData\Local\uwumonster.exe
    C:\Users\Admin\AppData\Local\uwumonster.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1028

Network

  • flag-us
    DNS
    bring-recorder.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    bring-recorder.gl.at.ply.gg
    IN A
    Response
    bring-recorder.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa
    IN PTR
    Response
  • flag-us
    DNS
    then-wheel.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    then-wheel.gl.at.ply.gg
    IN A
    Response
    then-wheel.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    72.239.69.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.239.69.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    teen-modes.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    teen-modes.gl.at.ply.gg
    IN A
    Response
    teen-modes.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    action-yesterday.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    action-yesterday.gl.at.ply.gg
    IN A
    Response
    action-yesterday.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    bring-recorder.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    bring-recorder.gl.at.ply.gg
    IN A
    Response
    bring-recorder.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    action-yesterday.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    action-yesterday.gl.at.ply.gg
    IN A
    Response
    action-yesterday.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    bring-recorder.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    bring-recorder.gl.at.ply.gg
    IN A
    Response
    bring-recorder.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    then-wheel.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    then-wheel.gl.at.ply.gg
    IN A
    Response
    then-wheel.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    bring-recorder.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    bring-recorder.gl.at.ply.gg
    IN A
    Response
    bring-recorder.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    then-wheel.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    then-wheel.gl.at.ply.gg
    IN A
    Response
    then-wheel.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    teen-modes.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    teen-modes.gl.at.ply.gg
    IN A
    Response
    teen-modes.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    action-yesterday.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    action-yesterday.gl.at.ply.gg
    IN A
    Response
    action-yesterday.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    bring-recorder.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    bring-recorder.gl.at.ply.gg
    IN A
    Response
    bring-recorder.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    then-wheel.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    then-wheel.gl.at.ply.gg
    IN A
    Response
    then-wheel.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    teen-modes.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    teen-modes.gl.at.ply.gg
    IN A
    Response
    teen-modes.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    action-yesterday.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    action-yesterday.gl.at.ply.gg
    IN A
    Response
    action-yesterday.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    bring-recorder.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    bring-recorder.gl.at.ply.gg
    IN A
    Response
    bring-recorder.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    then-wheel.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    then-wheel.gl.at.ply.gg
    IN A
    Response
    then-wheel.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    action-yesterday.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    action-yesterday.gl.at.ply.gg
    IN A
    Response
    action-yesterday.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    bring-recorder.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    bring-recorder.gl.at.ply.gg
    IN A
    Response
    bring-recorder.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    teen-modes.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    teen-modes.gl.at.ply.gg
    IN A
    Response
    teen-modes.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    action-yesterday.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    action-yesterday.gl.at.ply.gg
    IN A
    Response
    action-yesterday.gl.at.ply.gg
    IN A
    147.185.221.19
  • flag-us
    DNS
    then-wheel.gl.at.ply.gg
    ya.exe
    Remote address:
    8.8.8.8:53
    Request
    then-wheel.gl.at.ply.gg
    IN A
    Response
    then-wheel.gl.at.ply.gg
    IN A
    147.185.221.19
  • 147.185.221.19:23638
    bring-recorder.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 127.0.0.1:23638
    ya.exe
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 127.0.0.1:23638
    ya.exe
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    bring-recorder.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    bring-recorder.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 127.0.0.1:23638
    ya.exe
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    bring-recorder.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 127.0.0.1:23638
    ya.exe
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 127.0.0.1:23638
    ya.exe
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 127.0.0.1:23638
    ya.exe
  • 147.185.221.19:23638
    bring-recorder.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    bring-recorder.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    bring-recorder.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 127.0.0.1:23638
    ya.exe
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 127.0.0.1:23638
    ya.exe
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 127.0.0.1:23638
    ya.exe
  • 127.0.0.1:23638
    ya.exe
  • 127.0.0.1:23638
    ya.exe
  • 147.185.221.19:23638
    bring-recorder.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 127.0.0.1:23638
    ya.exe
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 127.0.0.1:23638
    ya.exe
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    bring-recorder.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    bring-recorder.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    bring-recorder.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    teen-modes.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    action-yesterday.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 147.185.221.19:23638
    then-wheel.gl.at.ply.gg
    ya.exe
    156 B
     3
  • 8.8.8.8:53
    bring-recorder.gl.at.ply.gg
    dns
    ya.exe
    73 B
     89 B
     1
    1

    DNS Request

    bring-recorder.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa
    dns
    118 B
     182 B
     1
    1

    DNS Request

    0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa

  • 8.8.8.8:53
    then-wheel.gl.at.ply.gg
    dns
    ya.exe
    69 B
     85 B
     1
    1

    DNS Request

    then-wheel.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    72.239.69.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    72.239.69.13.in-addr.arpa

  • 8.8.8.8:53
    teen-modes.gl.at.ply.gg
    dns
    ya.exe
    69 B
     85 B
     1
    1

    DNS Request

    teen-modes.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    action-yesterday.gl.at.ply.gg
    dns
    ya.exe
    75 B
     91 B
     1
    1

    DNS Request

    action-yesterday.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    bring-recorder.gl.at.ply.gg
    dns
    ya.exe
    73 B
     89 B
     1
    1

    DNS Request

    bring-recorder.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    action-yesterday.gl.at.ply.gg
    dns
    ya.exe
    75 B
     91 B
     1
    1

    DNS Request

    action-yesterday.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    bring-recorder.gl.at.ply.gg
    dns
    ya.exe
    73 B
     89 B
     1
    1

    DNS Request

    bring-recorder.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    then-wheel.gl.at.ply.gg
    dns
    ya.exe
    69 B
     85 B
     1
    1

    DNS Request

    then-wheel.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    bring-recorder.gl.at.ply.gg
    dns
    ya.exe
    73 B
     89 B
     1
    1

    DNS Request

    bring-recorder.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    then-wheel.gl.at.ply.gg
    dns
    ya.exe
    69 B
     85 B
     1
    1

    DNS Request

    then-wheel.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    teen-modes.gl.at.ply.gg
    dns
    ya.exe
    69 B
     85 B
     1
    1

    DNS Request

    teen-modes.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    action-yesterday.gl.at.ply.gg
    dns
    ya.exe
    75 B
     91 B
     1
    1

    DNS Request

    action-yesterday.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    bring-recorder.gl.at.ply.gg
    dns
    ya.exe
    73 B
     89 B
     1
    1

    DNS Request

    bring-recorder.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    then-wheel.gl.at.ply.gg
    dns
    ya.exe
    69 B
     85 B
     1
    1

    DNS Request

    then-wheel.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    teen-modes.gl.at.ply.gg
    dns
    ya.exe
    69 B
     85 B
     1
    1

    DNS Request

    teen-modes.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    action-yesterday.gl.at.ply.gg
    dns
    ya.exe
    75 B
     91 B
     1
    1

    DNS Request

    action-yesterday.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    bring-recorder.gl.at.ply.gg
    dns
    ya.exe
    73 B
     89 B
     1
    1

    DNS Request

    bring-recorder.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    then-wheel.gl.at.ply.gg
    dns
    ya.exe
    69 B
     85 B
     1
    1

    DNS Request

    then-wheel.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    action-yesterday.gl.at.ply.gg
    dns
    ya.exe
    75 B
     91 B
     1
    1

    DNS Request

    action-yesterday.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    bring-recorder.gl.at.ply.gg
    dns
    ya.exe
    73 B
     89 B
     1
    1

    DNS Request

    bring-recorder.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    teen-modes.gl.at.ply.gg
    dns
    ya.exe
    69 B
     85 B
     1
    1

    DNS Request

    teen-modes.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    action-yesterday.gl.at.ply.gg
    dns
    ya.exe
    75 B
     91 B
     1
    1

    DNS Request

    action-yesterday.gl.at.ply.gg

    DNS Response

    147.185.221.19

  • 8.8.8.8:53
    then-wheel.gl.at.ply.gg
    dns
    ya.exe
    69 B
     85 B
     1
    1

    DNS Request

    then-wheel.gl.at.ply.gg

    DNS Response

    147.185.221.19

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\uwumonster.exe.log
    Filesize

    654B

    MD5

    16c5fce5f7230eea11598ec11ed42862

    SHA1

    75392d4824706090f5e8907eee1059349c927600

    SHA256

    87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

    SHA512

    153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

    Download Submit

  • C:\Users\Admin\AppData\Local\uwumonster.exe
    Filesize

    63KB

    MD5

    222c2d239f4c8a1d73c736c9cc712807

    SHA1

    c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c

    SHA256

    ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d

    SHA512

    1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02

    Download Submit

  • memory/1588-10-0x00007FFEBC2E0000-0x00007FFEBC4BB000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1588-12-0x00007FFEBC2E0000-0x00007FFEBC4BB000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2720-0-0x0000000000770000-0x0000000000786000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2720-1-0x00007FFEBC2E0000-0x00007FFEBC4BB000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2720-6-0x00007FFEBC2E0000-0x00007FFEBC4BB000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2720-7-0x00007FFEBC2E0000-0x00007FFEBC4BB000-memory.dmp

    Filesize

    1.9MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.