Overview
overview
4Static
static
3BetterFold...er.dll
windows7-x64
1BetterFold...er.dll
windows10-2004-x64
1CeleryApp.exe
windows7-x64
4CeleryApp.exe
windows10-2004-x64
1CeleryIn.dll
windows7-x64
1CeleryIn.dll
windows10-2004-x64
1CeleryInject.exe
windows7-x64
1CeleryInject.exe
windows10-2004-x64
1Costura.dll
windows7-x64
1Costura.dll
windows10-2004-x64
1Dragablz.dll
windows7-x64
1Dragablz.dll
windows10-2004-x64
1MaterialDe...rs.dll
windows7-x64
1MaterialDe...rs.dll
windows10-2004-x64
1MaterialDe...ns.dll
windows7-x64
1MaterialDe...ns.dll
windows10-2004-x64
1Microsoft....re.dll
windows7-x64
1Microsoft....re.dll
windows10-2004-x64
1Microsoft....ms.dll
windows7-x64
1Microsoft....ms.dll
windows10-2004-x64
1Microsoft....pf.dll
windows7-x64
1Microsoft....pf.dll
windows10-2004-x64
1Microsoft....rs.dll
windows7-x64
1Microsoft....rs.dll
windows10-2004-x64
1System.Dia...ce.dll
windows7-x64
1System.Dia...ce.dll
windows10-2004-x64
1bin/Monaco/index.html
windows7-x64
3bin/Monaco/index.html
windows10-2004-x64
3bin/Monaco...ain.js
windows7-x64
3bin/Monaco...ain.js
windows10-2004-x64
3bin/Monaco...tes.js
windows7-x64
3bin/Monaco...tes.js
windows10-2004-x64
3Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 23:58 UTC
Static task
static1
Behavioral task
behavioral1
Sample
BetterFolderBrowser.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
BetterFolderBrowser.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
CeleryApp.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
CeleryApp.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
CeleryIn.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
CeleryIn.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
CeleryInject.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
CeleryInject.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Costura.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Costura.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Dragablz.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
Dragablz.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
MaterialDesignColors.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
MaterialDesignColors.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
MaterialDesignExtensions.dll
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
MaterialDesignExtensions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Microsoft.Xaml.Behaviors.dll
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
Microsoft.Xaml.Behaviors.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
System.Diagnostics.DiagnosticSource.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
System.Diagnostics.DiagnosticSource.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
bin/Monaco/index.html
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
bin/Monaco/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes.js
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
bin/Monaco/vs/basic-languages/lua/autocompletes.js
Resource
win10v2004-20240802-en
General
-
Target
Costura.dll
-
Size
4KB
-
MD5
501981c7fc457d59238eb99780efb615
-
SHA1
f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
-
SHA256
41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
-
SHA512
5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
-
SSDEEP
48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
Malware Config
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A13.107.21.237dual-a-0034.a-msedge.netIN A204.79.197.237
-
Remote address:8.8.8.8:53Requestg.bing.comIN A
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request17.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request17.160.190.20.in-addr.arpaIN PTR
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2529c84570f948208d338cac9a5f2372&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2529c84570f948208d338cac9a5f2372&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=14EE589B33DA6814235D4C4E32FD696E; domain=.bing.com; expires=Tue, 02-Sep-2025 23:59:41 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8C00736EA91D429687F70F9424D03C84 Ref B: LON04EDGE0618 Ref C: 2024-08-08T23:59:41Z
date: Thu, 08 Aug 2024 23:59:41 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=2529c84570f948208d338cac9a5f2372&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=2529c84570f948208d338cac9a5f2372&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=14EE589B33DA6814235D4C4E32FD696E
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=XDDJT72WrgtvG1kX1OsMCV3TgGBt5G4OQ4U876BUQgw; domain=.bing.com; expires=Tue, 02-Sep-2025 23:59:41 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F77B6CDF16774C78B9549A2580359F0A Ref B: LON04EDGE0618 Ref C: 2024-08-08T23:59:41Z
date: Thu, 08 Aug 2024 23:59:41 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2529c84570f948208d338cac9a5f2372&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2529c84570f948208d338cac9a5f2372&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=14EE589B33DA6814235D4C4E32FD696E; MSPTC=XDDJT72WrgtvG1kX1OsMCV3TgGBt5G4OQ4U876BUQgw
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CBAC6D0B4DEB4053B2F8FE2AA3977108 Ref B: LON04EDGE0618 Ref C: 2024-08-08T23:59:42Z
date: Thu, 08 Aug 2024 23:59:41 GMT
-
Remote address:8.8.8.8:53Request237.21.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request25.140.123.92.in-addr.arpaIN PTRResponse25.140.123.92.in-addr.arpaIN PTRa92-123-140-25deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
13.107.21.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2529c84570f948208d338cac9a5f2372&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=tls, http22.3kB 9.4kB 23 20
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2529c84570f948208d338cac9a5f2372&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=2529c84570f948208d338cac9a5f2372&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2529c84570f948208d338cac9a5f2372&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=HTTP Response
204
-
112 B 151 B 2 1
DNS Request
g.bing.com
DNS Request
g.bing.com
DNS Response
13.107.21.237204.79.197.237
-
132 B 90 B 2 1
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
8.8.8.8.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
17.160.190.20.in-addr.arpa
DNS Request
17.160.190.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
237.21.107.13.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
25.140.123.92.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa