Overview

overview

10

Static

static

3

0237b61e61...e4.exe

windows7-x64

3

0237b61e61...e4.exe

windows10-2004-x64

10

0cbf9c5b59...f9.exe

windows10-2004-x64

10

0edb945c8d...dd.exe

windows10-2004-x64

10

13ca0bbb32...3f.exe

windows10-2004-x64

10

1465a638f9...f2.exe

windows10-2004-x64

10

1b0729839d...dd.exe

windows10-2004-x64

10

27bf431b08...9f.exe

windows10-2004-x64

10

34b8fdeeaf...27.exe

windows10-2004-x64

10

488c7cb3b3...18.exe

windows10-2004-x64

10

4bc64c0375...75.exe

windows10-2004-x64

10

4f85c3e4ec...fe.exe

windows10-2004-x64

10

55b18033bb...53.exe

windows7-x64

3

55b18033bb...53.exe

windows10-2004-x64

10

60e7e1ac00...07.exe

windows10-2004-x64

10

979a97cb16...99.exe

windows10-2004-x64

10

b3eb736a5d...9f.exe

windows10-2004-x64

10

d57352b171...d0.exe

windows10-2004-x64

10

d62f03a558...b6.exe

windows10-2004-x64

10

e72a6e51db...6d.exe

windows10-2004-x64

10

f5c9c18cca...6b.exe

windows10-2004-x64

10

fdb9b25099...78.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 12:57 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exe

  • Size

    389KB

  • MD5

    073f84f40946716ae47ea59af7fc3979

  • SHA1

    f39ce1dd5b30a263986c6831bc7bf4b662b3ce5c

  • SHA256

    4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675

  • SHA512

    7a9758b20b794cac8a5a9e8dae5fb55f6cfb5b69e8ab5ab804088e67975436826746e5fe18473f56e4544bf148c35dc1a1029768bf3262e58372afbc7d9ca93a

  • SSDEEP

    6144:KGy+bnr+xp0yN90QESFxnVkONlvhYZbG7qMh+hn0E3+YIu5ly4RChw/:yMrFy90wSONcbG75w3+YNly2Chw/

Score
10/10
healerredlinenasadropperevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes
  • auth_value

    6da71218d8a9738ea3a9a78b5677589b

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exe
    "C:\Users\Admin\AppData\Local\Temp\4bc64c0375f3ffea0f45741a1f4ed6af4f66e8f13084960da4aeb003e9f45675.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0401173.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0401173.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4607821.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4607821.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3188
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1698980.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1698980.exe
        3⤵
        • Executes dropped EXE
        PID:3060

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Q6gaN6iWji3FUdYlkNMC9jVUCUyrKRLzbcFy1vL58JwzePs0IhSmWr-YbwsUNFSr1_sqZ-D4Ac3nwM1shDWxF0-UMHnbp5iwtnjXibv_JJ0ZQK6VS4wvqec5Ny_J66AVUdDY3Pt0VT0LblIE9jz0ZE6wpKO1eqCGmzChLM-p9cIZ_-AE%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcbe58035ad7913364a63e61e0aae3d2e&TIME=20240426T131118Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Q6gaN6iWji3FUdYlkNMC9jVUCUyrKRLzbcFy1vL58JwzePs0IhSmWr-YbwsUNFSr1_sqZ-D4Ac3nwM1shDWxF0-UMHnbp5iwtnjXibv_JJ0ZQK6VS4wvqec5Ny_J66AVUdDY3Pt0VT0LblIE9jz0ZE6wpKO1eqCGmzChLM-p9cIZ_-AE%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcbe58035ad7913364a63e61e0aae3d2e&TIME=20240426T131118Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=137D03331C0A6F8B1D9417491DB16EA3; domain=.bing.com; expires=Tue, 03-Jun-2025 12:57:25 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: CED2BC57A29C4C3798095DAB8F39F5E0 Ref B: LON04EDGE0920 Ref C: 2024-05-09T12:57:25Z
    date: Thu, 09 May 2024 12:57:25 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Q6gaN6iWji3FUdYlkNMC9jVUCUyrKRLzbcFy1vL58JwzePs0IhSmWr-YbwsUNFSr1_sqZ-D4Ac3nwM1shDWxF0-UMHnbp5iwtnjXibv_JJ0ZQK6VS4wvqec5Ny_J66AVUdDY3Pt0VT0LblIE9jz0ZE6wpKO1eqCGmzChLM-p9cIZ_-AE%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcbe58035ad7913364a63e61e0aae3d2e&TIME=20240426T131118Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Q6gaN6iWji3FUdYlkNMC9jVUCUyrKRLzbcFy1vL58JwzePs0IhSmWr-YbwsUNFSr1_sqZ-D4Ac3nwM1shDWxF0-UMHnbp5iwtnjXibv_JJ0ZQK6VS4wvqec5Ny_J66AVUdDY3Pt0VT0LblIE9jz0ZE6wpKO1eqCGmzChLM-p9cIZ_-AE%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcbe58035ad7913364a63e61e0aae3d2e&TIME=20240426T131118Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=137D03331C0A6F8B1D9417491DB16EA3; _EDGE_S=SID=20F527509E5A6C5D3A4E332A9FF06D01
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=1HIuH-wDn67aoQP_nCfNvscQY3frfvPcpDSkOAhwENo; domain=.bing.com; expires=Tue, 03-Jun-2025 12:57:26 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: FA359E9B7C6342429E51C2DFAC4C08DC Ref B: LON04EDGE0920 Ref C: 2024-05-09T12:57:26Z
    date: Thu, 09 May 2024 12:57:26 GMT
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-be
    GET
    https://www.bing.com/aes/c.gif?RG=5c1af5315b364c9c9432f8c23d99fb94&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T131118Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038
    Remote address:
    88.221.83.202:443
    Request
    GET /aes/c.gif?RG=5c1af5315b364c9c9432f8c23d99fb94&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T131118Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038 HTTP/2.0
    host: www.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=137D03331C0A6F8B1D9417491DB16EA3
    Response
    HTTP/2.0 200
    cache-control: private,no-store
    pragma: no-cache
    vary: Origin
    p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 4447EB8E9A494B80B01E63D4D5E7B395 Ref B: DUS30EDGE0917 Ref C: 2024-05-09T12:57:26Z
    content-length: 0
    date: Thu, 09 May 2024 12:57:26 GMT
    set-cookie: _EDGE_S=SID=20F527509E5A6C5D3A4E332A9FF06D01; path=/; httponly; domain=bing.com
    set-cookie: MUIDB=137D03331C0A6F8B1D9417491DB16EA3; path=/; httponly; expires=Tue, 03-Jun-2025 12:57:26 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.c653dd58.1715259446.12d2be46
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-be
    GET
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    Remote address:
    88.221.83.202:443
    Request
    GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
    host: www.bing.com
    accept: */*
    cookie: MUID=137D03331C0A6F8B1D9417491DB16EA3; _EDGE_S=SID=20F527509E5A6C5D3A4E332A9FF06D01; MSPTC=1HIuH-wDn67aoQP_nCfNvscQY3frfvPcpDSkOAhwENo; MUIDB=137D03331C0A6F8B1D9417491DB16EA3
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-type: image/png
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    content-length: 1107
    date: Thu, 09 May 2024 12:57:27 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.c653dd58.1715259447.12d2c573
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    4.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    202.83.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    202.83.221.88.in-addr.arpa
    IN PTR
    Response
    202.83.221.88.in-addr.arpa
    IN PTR
    a88-221-83-202deploystaticakamaitechnologiescom
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    138.201.86.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    138.201.86.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    29.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    29.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340783938_154JBSOQL12JS43YR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239340783938_154JBSOQL12JS43YR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 627437
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 6A1942D0B46942129E95C4B879117B86 Ref B: LON04EDGE1015 Ref C: 2024-05-09T12:59:04Z
    date: Thu, 09 May 2024 12:59:03 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340783939_14IT4JGOWRFC6CMW9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239340783939_14IT4JGOWRFC6CMW9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 792794
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F36A771940A149D99416F35E4F0200EF Ref B: LON04EDGE1015 Ref C: 2024-05-09T12:59:04Z
    date: Thu, 09 May 2024 12:59:03 GMT
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Q6gaN6iWji3FUdYlkNMC9jVUCUyrKRLzbcFy1vL58JwzePs0IhSmWr-YbwsUNFSr1_sqZ-D4Ac3nwM1shDWxF0-UMHnbp5iwtnjXibv_JJ0ZQK6VS4wvqec5Ny_J66AVUdDY3Pt0VT0LblIE9jz0ZE6wpKO1eqCGmzChLM-p9cIZ_-AE%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcbe58035ad7913364a63e61e0aae3d2e&TIME=20240426T131118Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
    tls, http2
    2.5kB
     9.0kB
     19
    17

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Q6gaN6iWji3FUdYlkNMC9jVUCUyrKRLzbcFy1vL58JwzePs0IhSmWr-YbwsUNFSr1_sqZ-D4Ac3nwM1shDWxF0-UMHnbp5iwtnjXibv_JJ0ZQK6VS4wvqec5Ny_J66AVUdDY3Pt0VT0LblIE9jz0ZE6wpKO1eqCGmzChLM-p9cIZ_-AE%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcbe58035ad7913364a63e61e0aae3d2e&TIME=20240426T131118Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Q6gaN6iWji3FUdYlkNMC9jVUCUyrKRLzbcFy1vL58JwzePs0IhSmWr-YbwsUNFSr1_sqZ-D4Ac3nwM1shDWxF0-UMHnbp5iwtnjXibv_JJ0ZQK6VS4wvqec5Ny_J66AVUdDY3Pt0VT0LblIE9jz0ZE6wpKO1eqCGmzChLM-p9cIZ_-AE%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dcbe58035ad7913364a63e61e0aae3d2e&TIME=20240426T131118Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949

    HTTP Response

    204
  • 88.221.83.202:443
    https://www.bing.com/aes/c.gif?RG=5c1af5315b364c9c9432f8c23d99fb94&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T131118Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038
    tls, http2
    1.4kB
     5.3kB
     16
    11

    HTTP Request

    GET https://www.bing.com/aes/c.gif?RG=5c1af5315b364c9c9432f8c23d99fb94&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T131118Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038

    HTTP Response

    200
  • 88.221.83.202:443
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    tls, http2
    1.6kB
     6.4kB
     17
    12

    HTTP Request

    GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

    HTTP Response

    200
  • 77.91.68.68:19071
    r1698980.exe
    260 B
     5
  • 77.91.68.68:19071
    r1698980.exe
    260 B
     5
  • 77.91.68.68:19071
    r1698980.exe
    260 B
     5
  • 52.111.227.11:443
    322 B
     7
  • 77.91.68.68:19071
    r1698980.exe
    260 B
     5
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239340783939_14IT4JGOWRFC6CMW9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    51.0kB
     1.5MB
     1070
    1068

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340783938_154JBSOQL12JS43YR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340783939_14IT4JGOWRFC6CMW9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 77.91.68.68:19071
    r1698980.exe
    260 B
     5
  • 77.91.68.68:19071
    r1698980.exe
    208 B
     4
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    4.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    4.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    202.83.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    202.83.221.88.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    138.201.86.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    138.201.86.20.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    29.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    29.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    88.156.103.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0401173.exe
    Filesize

    206KB

    MD5

    4e23e3ed92f482907c31141926908a4f

    SHA1

    6a090640bedf02b74bb7dad0b75c380d444f73fc

    SHA256

    239a61d49eb6b626bd249926a1a3225d6005efe83cfbf21091cd381af22172d7

    SHA512

    273e0ad97c40f1f70375251e66ce7f33bf54ae6dc068fdb3156925f59433009a16835ea1e528ab1422c26952b3835f62aff4ef267749978ad0e7725133920e8d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p4607821.exe
    Filesize

    14KB

    MD5

    24680878da0cdb572f04dee724eb6374

    SHA1

    e541d64aadaa8bbc00544fe62476886e15ffbe48

    SHA256

    1ec13c26ada790637e7432690f135d84911e69be30fffbc673c0e63e2c7d1c3f

    SHA512

    9196bb471e2a2eac844320afc95198af35c06d7c87dfd39779c69f1856fcec452c30dd61b1117eef825566cfee1e6f2b0962fed07fae269cd502263b008b5779

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1698980.exe
    Filesize

    173KB

    MD5

    42d0dd8ee8b60ffcca10b682dccea2a2

    SHA1

    d6069d38777c71e088d5addc73f6cce3a4bc8bd6

    SHA256

    b0df05a1010f5da959d2539eb1014155e1859164aac2df73acd63a4990c97be4

    SHA512

    ef304513350ff736d53cbfd87973cacdfe7251edc94cf57f75bfcfa3bc73f63116cc8bd931e25fe9f75718f344667c8a36706bd0c179e0678423a9c50842aa92

    Download Submit

  • memory/3060-20-0x0000000000040000-0x0000000000070000-memory.dmp

    Filesize

    192KB

    Download

  • memory/3060-21-0x0000000004960000-0x0000000004966000-memory.dmp

    Filesize

    24KB

    Download

  • memory/3060-22-0x000000000A390000-0x000000000A9A8000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3060-23-0x0000000009EB0000-0x0000000009FBA000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/3060-24-0x0000000009DF0000-0x0000000009E02000-memory.dmp

    Filesize

    72KB

    Download

  • memory/3060-25-0x0000000009E50000-0x0000000009E8C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3060-26-0x0000000004320000-0x000000000436C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/3188-14-0x00007FFB34E53000-0x00007FFB34E55000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3188-15-0x0000000000C70000-0x0000000000C7A000-memory.dmp

    Filesize

    40KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.