Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

07ebb70eb0...5f.exe

windows7-x64

3

07ebb70eb0...5f.exe

windows10-2004-x64

10

0b4bb67302...ca.exe

windows10-2004-x64

9

0fbb8ff4cb...49.exe

windows10-2004-x64

10

108e20eafa...c7.exe

windows7-x64

3

108e20eafa...c7.exe

windows10-2004-x64

10

1522207077...0f.exe

windows10-2004-x64

10

23fcf9bc69...25.exe

windows10-2004-x64

10

2ca9135451...23.exe

windows7-x64

3

2ca9135451...23.exe

windows10-2004-x64

10

42f53acaac...33.exe

windows10-2004-x64

10

45af188d23...c0.exe

windows10-2004-x64

10

82fa18f52c...32.exe

windows7-x64

3

82fa18f52c...32.exe

windows10-2004-x64

10

8672d19897...4f.exe

windows10-2004-x64

10

8ceedf9abd...f7.exe

windows10-2004-x64

10

99cc81196c...15.exe

windows7-x64

3

99cc81196c...15.exe

windows10-2004-x64

10

a2aa61942b...83.exe

windows7-x64

3

a2aa61942b...83.exe

windows10-2004-x64

10

c467adbd48...9e.exe

windows10-2004-x64

10

f7dfe59831...a0.exe

windows10-2004-x64

10

fc29a80a1c...7d.exe

windows10-2004-x64

10

fdc14a13fe...6d.exe

windows7-x64

fdc14a13fe...6d.exe

windows10-2004-x64

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 10:00 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f.exe

  • Size

    762KB

  • MD5

    56b4ec09b7959eab1c27ee19fc26f92e

  • SHA1

    ec6547336820cd65aa0b5122b46dd154f7235c48

  • SHA256

    8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f

  • SHA512

    c037beb0258697df44828b0902ba5d054160aa8e8a5877c7d151d11614a0bb81af284a223985c367d2978142a80e604efc21bf02730451c5ad36d0f0a4597508

  • SSDEEP

    12288:HMr6y90cYfR5WWXXxFeVB5U5MZOVQTsX1YKFcL9B0Pf/aG9fn0Ev5:JytYffPXr5ATsELb0PT1n0Ev5

Score
10/10
redlinedebroinfostealerpersistence

Malware Config

Extracted

Family

redline

Botnet

debro

C2

185.161.248.75:4132

Attributes
  • auth_value

    18c2c191aebfde5d1787ec8d805a01a8

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f.exe
    "C:\Users\Admin\AppData\Local\Temp\8672d19897720829ca8e3d11e92f295b615d0fb57d0ae1c17f1358f55bcdc74f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3108
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7741946.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7741946.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7311706.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7311706.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1188
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8054662.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8054662.exe
          4⤵
          • Executes dropped EXE
          PID:1664

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De81tQRLJP9zH4T-TEcA7rhkjVUCUyFz9myDoya3CpqzvRxbYxqfZ2IoYfoFAds81UqSmspY4FnUZQ-IgN6JKLM82UjP2K5THuatmrwTxwuu3hE1tKxROuzMb6OZtOWHZLbqzLpnpySEBkWiv3AxbPbNmew57refHIhnVa-y1ehc5sXt8qH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D3da3516a37de13c38fea37516cb980b4&TIME=20240508T110126Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De81tQRLJP9zH4T-TEcA7rhkjVUCUyFz9myDoya3CpqzvRxbYxqfZ2IoYfoFAds81UqSmspY4FnUZQ-IgN6JKLM82UjP2K5THuatmrwTxwuu3hE1tKxROuzMb6OZtOWHZLbqzLpnpySEBkWiv3AxbPbNmew57refHIhnVa-y1ehc5sXt8qH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D3da3516a37de13c38fea37516cb980b4&TIME=20240508T110126Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=293EACE5D7DC6135221AB89BD63C60D1; domain=.bing.com; expires=Sat, 07-Jun-2025 10:01:05 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 9604D31C2C3E4BD8BA3A83B2460AAD50 Ref B: LON04EDGE1216 Ref C: 2024-05-13T10:01:05Z
    date: Mon, 13 May 2024 10:01:05 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De81tQRLJP9zH4T-TEcA7rhkjVUCUyFz9myDoya3CpqzvRxbYxqfZ2IoYfoFAds81UqSmspY4FnUZQ-IgN6JKLM82UjP2K5THuatmrwTxwuu3hE1tKxROuzMb6OZtOWHZLbqzLpnpySEBkWiv3AxbPbNmew57refHIhnVa-y1ehc5sXt8qH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D3da3516a37de13c38fea37516cb980b4&TIME=20240508T110126Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De81tQRLJP9zH4T-TEcA7rhkjVUCUyFz9myDoya3CpqzvRxbYxqfZ2IoYfoFAds81UqSmspY4FnUZQ-IgN6JKLM82UjP2K5THuatmrwTxwuu3hE1tKxROuzMb6OZtOWHZLbqzLpnpySEBkWiv3AxbPbNmew57refHIhnVa-y1ehc5sXt8qH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D3da3516a37de13c38fea37516cb980b4&TIME=20240508T110126Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=293EACE5D7DC6135221AB89BD63C60D1; _EDGE_S=SID=0EEF9E4F1C0B63A716CC8A311DE66270
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=2G_3rAMt2uXrdAPbhnsdpPOPIPYMHGk2XjAY34Zyh84; domain=.bing.com; expires=Sat, 07-Jun-2025 10:01:05 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 394347EE82494C2C8DC73316EB9D4C39 Ref B: LON04EDGE1216 Ref C: 2024-05-13T10:01:05Z
    date: Mon, 13 May 2024 10:01:05 GMT
  • flag-be
    GET
    https://www.bing.com/aes/c.gif?RG=4f1144530b284a8ca704d549d7e91182&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110126Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981
    Remote address:
    88.221.83.195:443
    Request
    GET /aes/c.gif?RG=4f1144530b284a8ca704d549d7e91182&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110126Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981 HTTP/2.0
    host: www.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=293EACE5D7DC6135221AB89BD63C60D1
    Response
    HTTP/2.0 200
    cache-control: private,no-store
    pragma: no-cache
    vary: Origin
    p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 76A94B1F2DB8498EAE2BE93EE127D754 Ref B: AMS04EDGE3622 Ref C: 2024-05-13T10:01:05Z
    content-length: 0
    date: Mon, 13 May 2024 10:01:05 GMT
    set-cookie: _EDGE_S=SID=0EEF9E4F1C0B63A716CC8A311DE66270; path=/; httponly; domain=bing.com
    set-cookie: MUIDB=293EACE5D7DC6135221AB89BD63C60D1; path=/; httponly; expires=Sat, 07-Jun-2025 10:01:05 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.bf53dd58.1715594465.1dad2b06
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    195.83.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    195.83.221.88.in-addr.arpa
    IN PTR
    Response
    195.83.221.88.in-addr.arpa
    IN PTR
    a88-221-83-195deploystaticakamaitechnologiescom
  • flag-us
    DNS
    0.204.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.204.248.87.in-addr.arpa
    IN PTR
    Response
    0.204.248.87.in-addr.arpa
    IN PTR
    https-87-248-204-0lhrllnwnet
  • flag-be
    GET
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    Remote address:
    88.221.83.195:443
    Request
    GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
    host: www.bing.com
    accept: */*
    cookie: MUID=293EACE5D7DC6135221AB89BD63C60D1; _EDGE_S=SID=0EEF9E4F1C0B63A716CC8A311DE66270; MSPTC=2G_3rAMt2uXrdAPbhnsdpPOPIPYMHGk2XjAY34Zyh84; MUIDB=293EACE5D7DC6135221AB89BD63C60D1
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-type: image/png
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    content-length: 1107
    date: Mon, 13 May 2024 10:01:06 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.bf53dd58.1715594466.1dad3113
  • flag-us
    DNS
    20.177.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    20.177.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    205.47.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.47.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    139.53.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    139.53.16.96.in-addr.arpa
    IN PTR
    Response
    139.53.16.96.in-addr.arpa
    IN PTR
    a96-16-53-139deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    27.73.42.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    27.73.42.20.in-addr.arpa
    IN PTR
    Response
  • 185.161.248.75:4132
    f8054662.exe
    260 B
     5
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De81tQRLJP9zH4T-TEcA7rhkjVUCUyFz9myDoya3CpqzvRxbYxqfZ2IoYfoFAds81UqSmspY4FnUZQ-IgN6JKLM82UjP2K5THuatmrwTxwuu3hE1tKxROuzMb6OZtOWHZLbqzLpnpySEBkWiv3AxbPbNmew57refHIhnVa-y1ehc5sXt8qH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D3da3516a37de13c38fea37516cb980b4&TIME=20240508T110126Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB
    tls, http2
    2.5kB
     9.0kB
     20
    17

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De81tQRLJP9zH4T-TEcA7rhkjVUCUyFz9myDoya3CpqzvRxbYxqfZ2IoYfoFAds81UqSmspY4FnUZQ-IgN6JKLM82UjP2K5THuatmrwTxwuu3hE1tKxROuzMb6OZtOWHZLbqzLpnpySEBkWiv3AxbPbNmew57refHIhnVa-y1ehc5sXt8qH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D3da3516a37de13c38fea37516cb980b4&TIME=20240508T110126Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De81tQRLJP9zH4T-TEcA7rhkjVUCUyFz9myDoya3CpqzvRxbYxqfZ2IoYfoFAds81UqSmspY4FnUZQ-IgN6JKLM82UjP2K5THuatmrwTxwuu3hE1tKxROuzMb6OZtOWHZLbqzLpnpySEBkWiv3AxbPbNmew57refHIhnVa-y1ehc5sXt8qH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D3da3516a37de13c38fea37516cb980b4&TIME=20240508T110126Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB

    HTTP Response

    204
  • 88.221.83.195:443
    https://www.bing.com/aes/c.gif?RG=4f1144530b284a8ca704d549d7e91182&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110126Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981
    tls, http2
    1.4kB
     5.3kB
     16
    10

    HTTP Request

    GET https://www.bing.com/aes/c.gif?RG=4f1144530b284a8ca704d549d7e91182&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110126Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981

    HTTP Response

    200
  • 88.221.83.195:443
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    tls, http2
    1.6kB
     6.4kB
     16
    12

    HTTP Request

    GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

    HTTP Response

    200
  • 185.161.248.75:4132
    f8054662.exe
    260 B
     5
  • 185.161.248.75:4132
    f8054662.exe
    260 B
     5
  • 185.161.248.75:4132
    f8054662.exe
    260 B
     5
  • 185.161.248.75:4132
    f8054662.exe
    260 B
     5
  • 185.161.248.75:4132
    f8054662.exe
    260 B
     5
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    195.83.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    195.83.221.88.in-addr.arpa

  • 8.8.8.8:53
    0.204.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    0.204.248.87.in-addr.arpa

  • 8.8.8.8:53
    20.177.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    20.177.190.20.in-addr.arpa

  • 8.8.8.8:53
    205.47.74.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    205.47.74.20.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    139.53.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    139.53.16.96.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    27.73.42.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    27.73.42.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7741946.exe
    Filesize

    488KB

    MD5

    1c6e0906d11b4bc3d241351998ea589b

    SHA1

    fca1f572444c36bab6ab66ac9128edc0d44674de

    SHA256

    05820ee56ffff9d4c8fc734d7a0c8aecd0b6727ddc4973a5a7b05723103c9b41

    SHA512

    820d0a5f56f7d45c50c1ff68e76f571fa605b9dce5f9e20fe6c7eaa345b676acc2d158435920ab6bab9f44e1f9cd3215701819ce85b890a41df7e07986d077e8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7311706.exe
    Filesize

    316KB

    MD5

    86a80836219856467f3d6c6306a78d01

    SHA1

    ba5efffffe7a8475e307c94f5e2ad8376fa03fea

    SHA256

    585b7ec0bc0b3b0cdd09aa45f34f46984cc2526cb60f30f17ae1ee481c5af417

    SHA512

    98863826016da09cf9057ec859f8ac328183944dd7b84d2c8f7f2b54349af58162db512e68a92cd7eb9aceb9ad374213c477af014d694319ff7eb9e4019670c2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8054662.exe
    Filesize

    168KB

    MD5

    e352c91d3659cda91423b8ec73c5108c

    SHA1

    613cbcc23173c896c0d603d0a8e329dfbb6c2ce4

    SHA256

    cb45cbea63a6b9f7ef481cd98697c130516838bf6563ad517236f7a640ada6cc

    SHA512

    7cc86ef3927c852c46006471a157f75a3ace871869269c47bfa0d5be099fbe82fffba0461a803983ed79b822290dc706c77bd2e31164db66bacce02dd14494d0

    Download Submit

  • memory/1664-21-0x0000000000F70000-0x0000000000F9E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/1664-22-0x0000000001820000-0x0000000001826000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1664-23-0x0000000005FD0000-0x00000000065E8000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/1664-24-0x0000000005AC0000-0x0000000005BCA000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1664-25-0x00000000058E0000-0x00000000058F2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1664-26-0x0000000005940000-0x000000000597C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/1664-27-0x00000000059B0000-0x00000000059FC000-memory.dmp

    Filesize

    304KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.