Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 13:00 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0.exe

  • Size

    382KB

  • MD5

    278218d2ac13d2d7134e6e9a0828e4d5

  • SHA1

    05066b895c41396d0321bc3a032f2f7c2e1811e3

  • SHA256

    c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0

  • SHA512

    f1e41a457c01a6ad0ac00e3a004023429d644b1a9bb193afd277f333f1bd4bd00059e37c6df2565b9c7e8bda3cbe3f713b2d39d04ca0c5ad169788efdb230b7d

  • SSDEEP

    6144:1jNHmrGVx/2m1f+eo864r+m4fSw3Axa3Uet46nBeJKts:1jNGexJo8raXfS8Axa35t46nUJKts

Score
10/10
stealczgratdiscoveryratstealer

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:660
    • C:\Users\Admin\AppData\Local\Temp\uic.0.exe
      "C:\Users\Admin\AppData\Local\Temp\uic.0.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:1652
    • C:\Users\Admin\AppData\Local\Temp\uic.1.exe
      "C:\Users\Admin\AppData\Local\Temp\uic.1.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3064
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 1152
      2⤵
      • Program crash
      PID:3444
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1280,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
    1⤵
      PID:3428
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 660 -ip 660
      1⤵
        PID:3472

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        67.31.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        67.31.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-be
        GET
        https://www.bing.com/th?id=OADD2.10239368184744_14DPBWVU0KKOKDZ8E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=48&h=48&dynsize=1&qlt=90
        Remote address:
        88.221.83.187:443
        Request
        GET /th?id=OADD2.10239368184744_14DPBWVU0KKOKDZ8E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=48&h=48&dynsize=1&qlt=90 HTTP/2.0
        host: www.bing.com
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-type: image/png
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        content-length: 5773
        date: Thu, 09 May 2024 13:00:17 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.b753dd58.1715259617.9072662
      • flag-us
        DNS
        187.83.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        187.83.221.88.in-addr.arpa
        IN PTR
        Response
        187.83.221.88.in-addr.arpa
        IN PTR
        a88-221-83-187deploystaticakamaitechnologiescom
      • flag-us
        DNS
        57.169.31.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        57.169.31.20.in-addr.arpa
        IN PTR
        Response
      • flag-de
        GET
        http://185.172.128.90/cpa/ping.php?substr=one&s=ab&sub=0
        c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0.exe
        Remote address:
        185.172.128.90:80
        Request
        GET /cpa/ping.php?substr=one&s=ab&sub=0 HTTP/1.1
        Host: 185.172.128.90
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Thu, 09 May 2024 13:00:23 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 1
        Content-Type: text/html; charset=UTF-8
      • flag-de
        GET
        http://185.172.128.228/ping.php?substr=one
        c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0.exe
        Remote address:
        185.172.128.228:80
        Request
        GET /ping.php?substr=one HTTP/1.1
        Host: 185.172.128.228
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Thu, 09 May 2024 13:00:25 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Content-Type: text/html; charset=UTF-8
      • flag-de
        GET
        http://185.172.128.59/syncUpd.exe
        c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0.exe
        Remote address:
        185.172.128.59:80
        Request
        GET /syncUpd.exe HTTP/1.1
        Host: 185.172.128.59
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Thu, 09 May 2024 13:00:25 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Thu, 09 May 2024 13:00:01 GMT
        ETag: "36800-61804ff3cf00a"
        Accept-Ranges: bytes
        Content-Length: 223232
        Content-Type: application/x-msdos-program
      • flag-us
        DNS
        228.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        90.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        90.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-de
        GET
        http://185.172.128.228/BroomSetup.exe
        c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0.exe
        Remote address:
        185.172.128.228:80
        Request
        GET /BroomSetup.exe HTTP/1.1
        Host: 185.172.128.228
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Thu, 09 May 2024 13:00:26 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Fri, 15 Mar 2024 11:59:56 GMT
        ETag: "4a4030-613b1bf118700"
        Accept-Ranges: bytes
        Content-Length: 4866096
        Content-Type: application/x-msdos-program
      • flag-us
        DNS
        59.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        59.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        59.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        59.128.172.185.in-addr.arpa
        IN PTR
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        uic.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----FHJKKECFIECAKECAFBGC
        Host: 185.172.128.150
        Content-Length: 217
        Connection: Keep-Alive
        Cache-Control: no-cache
      • flag-us
        DNS
        150.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        150.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        svc.iolo.com
        uic.1.exe
        Remote address:
        8.8.8.8:53
        Request
        svc.iolo.com
        IN A
        Response
        svc.iolo.com
        IN A
        20.157.87.45
      • flag-us
        POST
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        uic.1.exe
        Remote address:
        20.157.87.45:80
        Request
        POST /__svc/sbv/DownloadManager.ashx HTTP/1.0
        Connection: keep-alive
        Content-Length: 300
        Host: svc.iolo.com
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Encoding: identity
        User-Agent: Mozilla/3.0 (compatible; Indy Library)
        Response
        HTTP/1.1 200 OK
        cache-control: private
        content-length: 256
        content-type: text/html; charset=utf-8
        x-whom: Ioloweb5
        date: Thu, 09 May 2024 13:00:35 GMT
        set-cookie: SERVERID=svc5; path=/
        connection: close
      • flag-us
        DNS
        45.87.157.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        45.87.157.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        download.iolo.net
        Remote address:
        8.8.8.8:53
        Request
        download.iolo.net
        IN A
        Response
        download.iolo.net
        IN CNAME
        iolo0.b-cdn.net
        iolo0.b-cdn.net
        IN A
        185.93.2.251
      • flag-fr
        HEAD
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe
        Remote address:
        185.93.2.251:443
        Request
        HEAD /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe HTTP/2.0
        host: download.iolo.net
        accept: */*
        accept-encoding: identity
        user-agent: Microsoft BITS/7.8
        Response
        HTTP/2.0 200
        date: Thu, 09 May 2024 13:00:42 GMT
        content-type: application/octet-stream
        content-length: 58919336
        server: BunnyCDN-FR1-1186
        cdn-pullzone: 1654350
        cdn-uid: 5b8ea5d8-68d6-4057-a57d-a5f315142028
        cdn-requestcountrycode: GB
        cache-control: public, max-age=259200
        last-modified: Mon, 29 Apr 2024 18:38:19 GMT
        cdn-storageserver: DE-664
        cdn-fileserver: 594
        cdn-proxyver: 1.04
        cdn-requestpullsuccess: True
        cdn-requestpullcode: 206
        cdn-cachedat: 05/06/2024 22:02:11
        cdn-edgestorageid: 1187
        cdn-status: 200
        cdn-requestid: bec26d6a580ac0fcc34ddda9681d3aef
        cdn-cache: HIT
        accept-ranges: bytes
      • flag-fr
        GET
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe
        Remote address:
        185.93.2.251:443
        Request
        GET /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe HTTP/2.0
        host: download.iolo.net
        accept: */*
        accept-encoding: identity
        if-unmodified-since: Mon, 29 Apr 2024 18:38:19 GMT
        user-agent: Microsoft BITS/7.8
        Response
        HTTP/2.0 200
        date: Thu, 09 May 2024 13:00:42 GMT
        content-type: application/octet-stream
        content-length: 58919336
        server: BunnyCDN-FR1-1186
        cdn-pullzone: 1654350
        cdn-uid: 5b8ea5d8-68d6-4057-a57d-a5f315142028
        cdn-requestcountrycode: GB
        cache-control: public, max-age=259200
        last-modified: Mon, 29 Apr 2024 18:38:19 GMT
        cdn-storageserver: DE-664
        cdn-fileserver: 594
        cdn-proxyver: 1.04
        cdn-requestpullsuccess: True
        cdn-requestpullcode: 206
        cdn-cachedat: 05/06/2024 22:02:11
        cdn-edgestorageid: 1187
        cdn-status: 200
        cdn-requestid: bb2a89e501d9e3c182f5a214b44de9db
        cdn-cache: HIT
        accept-ranges: bytes
      • flag-us
        DNS
        251.2.93.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        251.2.93.185.in-addr.arpa
        IN PTR
        Response
        251.2.93.185.in-addr.arpa
        IN PTR
        185-93-2-251 bunnyinfranet
      • flag-us
        DNS
        86.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        86.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        86.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        86.23.85.13.in-addr.arpa
        IN PTR
      • flag-us
        POST
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        uic.1.exe
        Remote address:
        20.157.87.45:80
        Request
        POST /__svc/sbv/DownloadManager.ashx HTTP/1.0
        Connection: keep-alive
        Content-Length: 300
        Host: svc.iolo.com
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Encoding: identity
        User-Agent: Mozilla/3.0 (compatible; Indy Library)
        Response
        HTTP/1.1 200 OK
        cache-control: private
        content-length: 192
        content-type: text/html; charset=utf-8
        x-whom: Ioloweb7
        date: Thu, 09 May 2024 13:00:48 GMT
        set-cookie: SERVERID=svc7; path=/
        connection: close
      • flag-us
        DNS
        15.164.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        15.164.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        57.15.31.184.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        57.15.31.184.in-addr.arpa
        IN PTR
        Response
        57.15.31.184.in-addr.arpa
        IN PTR
        a184-31-15-57deploystaticakamaitechnologiescom
      • flag-us
        DNS
        57.15.31.184.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        57.15.31.184.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        westus2-2.in.applicationinsights.azure.com
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        Remote address:
        8.8.8.8:53
        Request
        westus2-2.in.applicationinsights.azure.com
        IN A
        Response
        westus2-2.in.applicationinsights.azure.com
        IN CNAME
        westus2-2.in.ai.monitor.azure.com
        westus2-2.in.ai.monitor.azure.com
        IN CNAME
        westus2-2.in.ai.privatelink.monitor.azure.com
        westus2-2.in.ai.privatelink.monitor.azure.com
        IN CNAME
        gig-ai-prod-westus2-0.trafficmanager.net
        gig-ai-prod-westus2-0.trafficmanager.net
        IN CNAME
        gig-ai-prod-wus2-0-app-v4-tag.westus2.cloudapp.azure.com
        gig-ai-prod-wus2-0-app-v4-tag.westus2.cloudapp.azure.com
        IN A
        20.9.155.145
      • flag-us
        POST
        https://westus2-2.in.applicationinsights.azure.com/v2/track
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        Remote address:
        20.9.155.145:443
        Request
        POST /v2/track HTTP/1.1
        Content-Type: application/x-json-stream
        Content-Encoding: gzip
        Host: westus2-2.in.applicationinsights.azure.com
        Content-Length: 846
        Expect: 100-continue
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Transfer-Encoding: chunked
        Content-Type: application/json; charset=utf-8
        Server: Microsoft-HTTPAPI/2.0
        Strict-Transport-Security: max-age=31536000
        X-Content-Type-Options: nosniff
        Date: Thu, 09 May 2024 13:00:56 GMT
      • flag-us
        DNS
        145.155.9.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        145.155.9.20.in-addr.arpa
        IN PTR
        Response
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        uic.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----HJEBGHIEBFIJKECBKFHD
        Host: 185.172.128.150
        Content-Length: 196
        Connection: Keep-Alive
        Cache-Control: no-cache
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        uic.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFC
        Host: 185.172.128.150
        Content-Length: 195
        Connection: Keep-Alive
        Cache-Control: no-cache
      • flag-us
        DNS
        195.201.50.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        195.201.50.20.in-addr.arpa
        IN PTR
        Response
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        uic.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----HIDGCFBFBFBKEBGCAFCG
        Host: 185.172.128.150
        Content-Length: 4751
        Connection: Keep-Alive
        Cache-Control: no-cache
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/sqlite3.dll
        uic.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/sqlite3.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
      • 88.221.83.187:443
        https://www.bing.com/th?id=OADD2.10239368184744_14DPBWVU0KKOKDZ8E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=48&h=48&dynsize=1&qlt=90
        tls, http2
        1.7kB
         11.6kB
         22
        16

        HTTP Request

        GET https://www.bing.com/th?id=OADD2.10239368184744_14DPBWVU0KKOKDZ8E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=48&h=48&dynsize=1&qlt=90

        HTTP Response

        200
      • 185.172.128.90:80
        http://185.172.128.90/cpa/ping.php?substr=one&s=ab&sub=0
        http
        c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0.exe
        440 B
         280 B
         5
        3

        HTTP Request

        GET http://185.172.128.90/cpa/ping.php?substr=one&s=ab&sub=0

        HTTP Response

        200
      • 185.172.128.228:80
        http://185.172.128.228/ping.php?substr=one
        http
        c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0.exe
        374 B
         279 B
         4
        3

        HTTP Request

        GET http://185.172.128.228/ping.php?substr=one

        HTTP Response

        200
      • 185.172.128.59:80
        http://185.172.128.59/syncUpd.exe
        http
        c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0.exe
        6.2kB
         230.5kB
         123
        174

        HTTP Request

        GET http://185.172.128.59/syncUpd.exe

        HTTP Response

        200
      • 185.172.128.228:80
        http://185.172.128.228/BroomSetup.exe
        http
        c697ba11d34c3fcce2efe3d2699c68c933f986b36ccb6b9fb0e9c08fcbcfa7e0.exe
        106.7kB
         5.0MB
         2189
        3755

        HTTP Request

        GET http://185.172.128.228/BroomSetup.exe

        HTTP Response

        200
      • 185.172.128.150:80
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        http
        uic.0.exe
        603 B
         92 B
         4
        2

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php
      • 20.157.87.45:80
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        http
        uic.1.exe
        836 B
         721 B
         6
        6

        HTTP Request

        POST http://svc.iolo.com/__svc/sbv/DownloadManager.ashx

        HTTP Response

        200
      • 185.93.2.251:443
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe
        tls, http2
        2.3MB
         61.5MB
         39544
        44241

        HTTP Request

        HEAD https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe

        HTTP Response

        200

        HTTP Request

        GET https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe

        HTTP Response

        200
      • 20.157.87.45:80
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        http
        uic.1.exe
        836 B
         657 B
         6
        6

        HTTP Request

        POST http://svc.iolo.com/__svc/sbv/DownloadManager.ashx

        HTTP Response

        200
      • 20.9.155.145:443
        https://westus2-2.in.applicationinsights.azure.com/v2/track
        tls, http
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        2.0kB
         5.2kB
         11
        10

        HTTP Request

        POST https://westus2-2.in.applicationinsights.azure.com/v2/track

        HTTP Response

        200
      • 185.172.128.150:80
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        http
        uic.0.exe
        582 B
         92 B
         4
        2

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php
      • 185.172.128.150:80
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        http
        uic.0.exe
        581 B
         92 B
         4
        2

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php
      • 185.172.128.150:80
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        http
        uic.0.exe
        5.3kB
         212 B
         8
        5

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php
      • 185.172.128.150:80
        http://185.172.128.150/b7d0cfdb1d966bdd/sqlite3.dll
        http
        uic.0.exe
        232 B
         92 B
         3
        2

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/sqlite3.dll
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        67.31.126.40.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        67.31.126.40.in-addr.arpa

      • 8.8.8.8:53
        187.83.221.88.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        187.83.221.88.in-addr.arpa

      • 8.8.8.8:53
        57.169.31.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        57.169.31.20.in-addr.arpa

      • 8.8.8.8:53
        228.128.172.185.in-addr.arpa
        dns
        74 B
         74 B
         1
        1

        DNS Request

        228.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        90.128.172.185.in-addr.arpa
        dns
        73 B
         73 B
         1
        1

        DNS Request

        90.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        59.128.172.185.in-addr.arpa
        dns
        146 B
         73 B
         2
        1

        DNS Request

        59.128.172.185.in-addr.arpa

        DNS Request

        59.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        150.128.172.185.in-addr.arpa
        dns
        74 B
         74 B
         1
        1

        DNS Request

        150.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        svc.iolo.com
        dns
        uic.1.exe
        58 B
         74 B
         1
        1

        DNS Request

        svc.iolo.com

        DNS Response

        20.157.87.45

      • 8.8.8.8:53
        45.87.157.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        45.87.157.20.in-addr.arpa

      • 8.8.8.8:53
        download.iolo.net
        dns
        63 B
         105 B
         1
        1

        DNS Request

        download.iolo.net

        DNS Response

        185.93.2.251

      • 8.8.8.8:53
        251.2.93.185.in-addr.arpa
        dns
        71 B
         112 B
         1
        1

        DNS Request

        251.2.93.185.in-addr.arpa

      • 8.8.8.8:53
        86.23.85.13.in-addr.arpa
        dns
        140 B
         144 B
         2
        1

        DNS Request

        86.23.85.13.in-addr.arpa

        DNS Request

        86.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        15.164.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        15.164.165.52.in-addr.arpa

      • 8.8.8.8:53
        57.15.31.184.in-addr.arpa
        dns
        142 B
         135 B
         2
        1

        DNS Request

        57.15.31.184.in-addr.arpa

        DNS Request

        57.15.31.184.in-addr.arpa

      • 8.8.8.8:53
        westus2-2.in.applicationinsights.azure.com
        dns
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        88 B
         299 B
         1
        1

        DNS Request

        westus2-2.in.applicationinsights.azure.com

        DNS Response

        20.9.155.145

      • 8.8.8.8:53
        145.155.9.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        145.155.9.20.in-addr.arpa

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
         128 B
         1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        195.201.50.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        195.201.50.20.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
        Filesize

        3KB

        MD5

        2b85afc26624a5872fb92ec370db76c6

        SHA1

        865c38761276c01268299800d6aeb265162b6338

        SHA256

        2cb28246ab7021a51820b324ee0e6a89f7db885e380c13d70c9d3cc92161f876

        SHA512

        862f07dba6ed0d8202200b5e36c3b5167e0fc437a93c8feecc8d695dfa1e145df0e48add286914236bc724556e20282700b56dbb5c94c7c2f165a5991a9c0faf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\uic.0.exe
        Filesize

        218KB

        MD5

        5246be38e251c182f838adf4ef42ad40

        SHA1

        fe09ba5ee40d4c4897c8f8e3fa819c13b0e324d9

        SHA256

        7dbf762b2ef2b651a4e8c7b7d9b8996a1de0cfa44119452f1d3f29bfe03dfd86

        SHA512

        a3f7c75a2355935d19c733d67aeff3e08f382ae60c1ba45364974ff91ca779ac5e49c40475fe35b8923a130e8670de0311fdf3c03de935312869e9a9a8b21b14

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\uic.1.exe
        Filesize

        4.6MB

        MD5

        397926927bca55be4a77839b1c44de6e

        SHA1

        e10f3434ef3021c399dbba047832f02b3c898dbd

        SHA256

        4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

        SHA512

        cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

        Download Submit

      • memory/660-40-0x0000000000400000-0x000000000046F000-memory.dmp

        Filesize

        444KB

        Download

      • memory/660-38-0x0000000000400000-0x0000000002B1D000-memory.dmp

        Filesize

        39.1MB

        Download

      • memory/660-2-0x0000000004770000-0x00000000047DC000-memory.dmp

        Filesize

        432KB

        Download

      • memory/660-16-0x0000000000400000-0x0000000002B1D000-memory.dmp

        Filesize

        39.1MB

        Download

      • memory/660-3-0x0000000000400000-0x000000000046F000-memory.dmp

        Filesize

        444KB

        Download

      • memory/660-1-0x0000000002CD0000-0x0000000002DD0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/660-39-0x0000000004770000-0x00000000047DC000-memory.dmp

        Filesize

        432KB

        Download

      • memory/1652-18-0x0000000000400000-0x0000000002AF3000-memory.dmp

        Filesize

        38.9MB

        Download

      • memory/1652-17-0x0000000000400000-0x0000000002AF3000-memory.dmp

        Filesize

        38.9MB

        Download

      • memory/1652-110-0x0000000000400000-0x0000000002AF3000-memory.dmp

        Filesize

        38.9MB

        Download

      • memory/1652-107-0x0000000000400000-0x0000000002AF3000-memory.dmp

        Filesize

        38.9MB

        Download

      • memory/1652-103-0x0000000000400000-0x0000000002AF3000-memory.dmp

        Filesize

        38.9MB

        Download

      • memory/2488-67-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2488-70-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3064-77-0x000002082E470000-0x000002082E47A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3064-89-0x000002084DB60000-0x000002084DB98000-memory.dmp

        Filesize

        224KB

        Download

      • memory/3064-76-0x000002082E440000-0x000002082E464000-memory.dmp

        Filesize

        144KB

        Download

      • memory/3064-74-0x000002082E3E0000-0x000002082E3EC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/3064-78-0x00000208491E0000-0x000002084920A000-memory.dmp

        Filesize

        168KB

        Download

      • memory/3064-79-0x0000020849460000-0x0000020849512000-memory.dmp

        Filesize

        712KB

        Download

      • memory/3064-80-0x00000208497E0000-0x0000020849830000-memory.dmp

        Filesize

        320KB

        Download

      • memory/3064-81-0x0000020849790000-0x00000208497B2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/3064-82-0x000002082E480000-0x000002082E48A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3064-86-0x0000020849830000-0x0000020849B30000-memory.dmp

        Filesize

        3.0MB

        Download

      • memory/3064-88-0x000002084DBE0000-0x000002084DBE8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/3064-75-0x000002082E3D0000-0x000002082E3E4000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3064-90-0x000002084DB30000-0x000002084DB3E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/3064-91-0x000002084DB50000-0x000002084DB58000-memory.dmp

        Filesize

        32KB

        Download

      • memory/3064-92-0x000002084EA40000-0x000002084EA4A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3064-93-0x000002084ECF0000-0x000002084ED52000-memory.dmp

        Filesize

        392KB

        Download

      • memory/3064-94-0x000002084ED50000-0x000002084ED72000-memory.dmp

        Filesize

        136KB

        Download

      • memory/3064-95-0x000002084F2A0000-0x000002084F7C8000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/3064-98-0x000002084EA60000-0x000002084EA6C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/3064-99-0x000002084EE40000-0x000002084EEB6000-memory.dmp

        Filesize

        472KB

        Download

      • memory/3064-100-0x000002084EDA0000-0x000002084EDBE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/3064-73-0x000002082CA80000-0x000002082CA90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3064-72-0x0000020849540000-0x000002084964A000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3064-71-0x0000020828E20000-0x000002082C654000-memory.dmp

        Filesize

        56.2MB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.