lockbit | hxxps://github[.]com/whichbuffer/Lockbit-Black-3[.]0

Analysis

max time kernel
71s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 21:31 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/whichbuffer/Lockbit-Black-3.0

Score

10^/10

lockbit discovery ransomware

Malware Config

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs

resource	yara_rule
behavioral1/memory/4640-5-0x0000000000400000-0x000000000042C000-memory.dmp	family_lockbit
behavioral1/memory/4640-6-0x0000000000400000-0x000000000042C000-memory.dmp	family_lockbit

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3256	4640	WerFault.exe	116
2024	3268	WerFault.exe	122
4100	1936	WerFault.exe	125
1516	3116	WerFault.exe	130
4100	2464	WerFault.exe	133
816	2616	WerFault.exe	137
8	2032	WerFault.exe	141

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1296	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1296	AcroRd32.exe
1296	AcroRd32.exe
1296	AcroRd32.exe
1296	AcroRd32.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/whichbuffer/Lockbit-Black-3.0
1⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3516,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:1
1⤵
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3728,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
1⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5408,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
1⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5424,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
1⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5944,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
1⤵
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6056,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
1⤵
PID:520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6096,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
1⤵
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=5968,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
1⤵
PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6796,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
1⤵
PID:416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1280

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Lockbit-Black-3.0-main.zip\Lockbit-Black-3.0-main\Threat Spotlight Lockbit Black 3.0 Ransomware.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1296

C:\Users\Admin\AppData\Local\Temp\Temp1_{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 264
  2⤵
  - Program crash
  PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4640 -ip 4640
1⤵
PID:216

C:\Users\Admin\AppData\Local\Temp\Temp1_{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"
1⤵
PID:3268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 244
  2⤵
  - Program crash
  PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3268 -ip 3268
1⤵
PID:4448

C:\Users\Admin\AppData\Local\Temp\Temp1_{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"
1⤵
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 236
  2⤵
  - Program crash
  PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1936 -ip 1936
1⤵
PID:2464

C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
"C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 260
  2⤵
  - Program crash
  PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3116 -ip 3116
1⤵
PID:4448

C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
"C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"
1⤵
PID:2464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 220
  2⤵
  - Program crash
  PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2464 -ip 2464
1⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=1732,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
1⤵
PID:4128

C:\Users\Admin\AppData\Local\Temp\Temp1_{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"
1⤵
PID:2616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 232
  2⤵
  - Program crash
  PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2616 -ip 2616
1⤵
PID:4624

C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe
"C:\Users\Admin\Desktop\{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.exe"
1⤵
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 180
  2⤵
  - Program crash
  PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2032 -ip 2032
1⤵
PID:3432

Network

DNS

github.com

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.26.156.215
DNS

github.com

Remote address:

8.8.8.8:53

Request

github.com

IN Unknown

Response
DNS

github.com

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.26.156.215
DNS

business.bing.com

Remote address:

8.8.8.8:53

Request

business.bing.com

IN A

Response

business.bing.com

IN CNAME

business-bing-com.b-0005.b-msedge.net

business-bing-com.b-0005.b-msedge.net

IN CNAME

b-0005.b-msedge.net

b-0005.b-msedge.net

IN A

13.107.6.158
DNS

business.bing.com

Remote address:

8.8.8.8:53

Request

business.bing.com

IN Unknown

Response

business.bing.com

IN CNAME

business-bing-com.b-0005.b-msedge.net
DNS

bzib.nelreports.net

Remote address:

8.8.8.8:53

Request

bzib.nelreports.net

IN A

Response

bzib.nelreports.net

IN CNAME

bzib.nelreports.net.akamaized.net

bzib.nelreports.net.akamaized.net

IN CNAME

a416.dscd.akamai.net

a416.dscd.akamai.net

IN A

92.123.142.200

a416.dscd.akamai.net

IN A

92.123.140.42
DNS

bzib.nelreports.net

Remote address:

8.8.8.8:53

Request

bzib.nelreports.net

IN Unknown

Response

bzib.nelreports.net

IN CNAME

bzib.nelreports.net.akamaized.net

bzib.nelreports.net.akamaized.net

IN CNAME

a416.dscd.akamai.net
DNS

github.githubassets.com

Remote address:

8.8.8.8:53

Request

github.githubassets.com

IN A

Response

github.githubassets.com

IN A

185.199.110.154

github.githubassets.com

IN A

185.199.111.154

github.githubassets.com

IN A

185.199.109.154

github.githubassets.com

IN A

185.199.108.154
DNS

github.githubassets.com

Remote address:

8.8.8.8:53

Request

github.githubassets.com

IN Unknown

Response
DNS

avatars.githubusercontent.com

Remote address:

8.8.8.8:53

Request

avatars.githubusercontent.com

IN A

Response

avatars.githubusercontent.com

IN A

185.199.110.133

avatars.githubusercontent.com

IN A

185.199.111.133

avatars.githubusercontent.com

IN A

185.199.108.133

avatars.githubusercontent.com

IN A

185.199.109.133
DNS

avatars.githubusercontent.com

Remote address:

8.8.8.8:53

Request

avatars.githubusercontent.com

IN Unknown

Response
DNS

user-images.githubusercontent.com

Remote address:

8.8.8.8:53

Request

user-images.githubusercontent.com

IN A

Response

user-images.githubusercontent.com

IN A

185.199.108.133

user-images.githubusercontent.com

IN A

185.199.111.133

user-images.githubusercontent.com

IN A

185.199.109.133

user-images.githubusercontent.com

IN A

185.199.110.133
DNS

user-images.githubusercontent.com

Remote address:

8.8.8.8:53

Request

user-images.githubusercontent.com

IN Unknown

Response
DNS

github-cloud.s3.amazonaws.com

Remote address:

8.8.8.8:53

Request

github-cloud.s3.amazonaws.com

IN A

Response

github-cloud.s3.amazonaws.com

IN CNAME

s3-1-w.amazonaws.com

s3-1-w.amazonaws.com

IN CNAME

s3-w.us-east-1.amazonaws.com

s3-w.us-east-1.amazonaws.com

IN A

54.231.231.25

s3-w.us-east-1.amazonaws.com

IN A

54.231.132.113

s3-w.us-east-1.amazonaws.com

IN A

3.5.28.51

s3-w.us-east-1.amazonaws.com

IN A

52.216.10.179

s3-w.us-east-1.amazonaws.com

IN A

3.5.27.189

s3-w.us-east-1.amazonaws.com

IN A

3.5.29.51

s3-w.us-east-1.amazonaws.com

IN A

3.5.10.168

s3-w.us-east-1.amazonaws.com

IN A

52.216.42.201
DNS

github-cloud.s3.amazonaws.com

Remote address:

8.8.8.8:53

Request

github-cloud.s3.amazonaws.com

IN Unknown

Response

github-cloud.s3.amazonaws.com

IN CNAME

s3-1-w.amazonaws.com

s3-1-w.amazonaws.com

IN CNAME

s3-w.us-east-1.amazonaws.com
DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

215.156.26.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

215.156.26.20.in-addr.arpa

IN PTR

Response
DNS

64.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

64.159.190.20.in-addr.arpa

IN PTR

Response
DNS

200.142.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.142.123.92.in-addr.arpa

IN PTR

Response

200.142.123.92.in-addr.arpa

IN PTR

a92-123-142-200deploystaticakamaitechnologiescom
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR

Response
DNS

nav-edge.smartscreen.microsoft.com

Remote address:

8.8.8.8:53

Request

nav-edge.smartscreen.microsoft.com

IN A
DNS

nav-edge.smartscreen.microsoft.com

Remote address:

8.8.8.8:53

Request

nav-edge.smartscreen.microsoft.com

IN Unknown

Response

nav-edge.smartscreen.microsoft.com

IN CNAME

prod-atm-wds-edge.trafficmanager.net

prod-atm-wds-edge.trafficmanager.net

IN CNAME

prod-agic-uw-3.ukwest.cloudapp.azure.com
DNS

collector.github.com

Remote address:

8.8.8.8:53

Request

collector.github.com

IN A

Response

collector.github.com

IN CNAME

glb-db52c2cf8be544.github.com

glb-db52c2cf8be544.github.com

IN A

140.82.114.21
DNS

collector.github.com

Remote address:

8.8.8.8:53

Request

collector.github.com

IN Unknown

Response

collector.github.com

IN CNAME

glb-db52c2cf8be544.github.com
DNS

api.github.com

Remote address:

8.8.8.8:53

Request

api.github.com

IN A

Response

api.github.com

IN A

20.26.156.210
DNS

api.github.com

Remote address:

8.8.8.8:53

Request

api.github.com

IN Unknown

Response
DNS

154.110.199.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

154.110.199.185.in-addr.arpa

IN PTR

Response

154.110.199.185.in-addr.arpa

IN PTR

cdn-185-199-110-154githubcom
DNS

133.110.199.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.110.199.185.in-addr.arpa

IN PTR

Response

133.110.199.185.in-addr.arpa

IN PTR

cdn-185-199-110-133githubcom
DNS

233.129.101.95.in-addr.arpa

Remote address:

8.8.8.8:53

Request

233.129.101.95.in-addr.arpa

IN PTR

Response

233.129.101.95.in-addr.arpa

IN PTR

a95-101-129-233deploystaticakamaitechnologiescom
DNS

73.144.22.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.144.22.2.in-addr.arpa

IN PTR

Response

73.144.22.2.in-addr.arpa

IN PTR

a2-22-144-73deploystaticakamaitechnologiescom
DNS

nav-edge.smartscreen.microsoft.com

Remote address:

8.8.8.8:53

Request

nav-edge.smartscreen.microsoft.com

IN A

Response

nav-edge.smartscreen.microsoft.com

IN CNAME

prod-atm-wds-edge.trafficmanager.net

prod-atm-wds-edge.trafficmanager.net

IN CNAME

prod-agic-uw-3.ukwest.cloudapp.azure.com

prod-agic-uw-3.ukwest.cloudapp.azure.com

IN A

51.11.108.188
DNS

data-edge.smartscreen.microsoft.com

Remote address:

8.8.8.8:53

Request

data-edge.smartscreen.microsoft.com

IN A

Response

data-edge.smartscreen.microsoft.com

IN CNAME

prod-atm-wds-edge.trafficmanager.net

prod-atm-wds-edge.trafficmanager.net

IN CNAME

prod-agic-uw-3.ukwest.cloudapp.azure.com

prod-agic-uw-3.ukwest.cloudapp.azure.com

IN A

51.11.108.188
DNS

data-edge.smartscreen.microsoft.com

Remote address:

8.8.8.8:53

Request

data-edge.smartscreen.microsoft.com

IN Unknown

Response

data-edge.smartscreen.microsoft.com

IN CNAME

prod-atm-wds-edge.trafficmanager.net

prod-atm-wds-edge.trafficmanager.net

IN CNAME

prod-agic-us-2.uksouth.cloudapp.azure.com
DNS

21.114.82.140.in-addr.arpa

Remote address:

8.8.8.8:53

Request

21.114.82.140.in-addr.arpa

IN PTR

Response

21.114.82.140.in-addr.arpa

IN PTR

lb-140-82-114-21-iadgithubcom
DNS

210.156.26.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

210.156.26.20.in-addr.arpa

IN PTR

Response
DNS

188.108.11.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

188.108.11.51.in-addr.arpa

IN PTR

Response
DNS

github.com

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.26.156.215
DNS

github.com

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.26.156.215
DNS

codeload.github.com

Remote address:

8.8.8.8:53

Request

codeload.github.com

IN A

Response

codeload.github.com

IN A

20.26.156.216
DNS

codeload.github.com

Remote address:

8.8.8.8:53

Request

codeload.github.com

IN A

Response

codeload.github.com

IN A

20.26.156.216
DNS

codeload.github.com

Remote address:

8.8.8.8:53

Request

codeload.github.com

IN Unknown

Response
DNS

217.106.137.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.106.137.52.in-addr.arpa

IN PTR

Response
DNS

dl-edge.smartscreen.microsoft.com

Remote address:

8.8.8.8:53

Request

dl-edge.smartscreen.microsoft.com

IN A

Response

dl-edge.smartscreen.microsoft.com

IN CNAME

prod-atm-wds-edge.trafficmanager.net

prod-atm-wds-edge.trafficmanager.net

IN CNAME

prod-agic-uw-3.ukwest.cloudapp.azure.com

prod-agic-uw-3.ukwest.cloudapp.azure.com

IN A

51.11.108.188
DNS

dl-edge.smartscreen.microsoft.com

Remote address:

8.8.8.8:53

Request

dl-edge.smartscreen.microsoft.com

IN Unknown

Response

dl-edge.smartscreen.microsoft.com

IN CNAME

prod-atm-wds-edge.trafficmanager.net

prod-atm-wds-edge.trafficmanager.net

IN CNAME

prod-agic-uw-3.ukwest.cloudapp.azure.com
DNS

216.156.26.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

216.156.26.20.in-addr.arpa

IN PTR

Response
DNS

26.165.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.165.165.52.in-addr.arpa

IN PTR

Response
DNS

15.164.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.164.165.52.in-addr.arpa

IN PTR

Response
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

14.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.227.111.52.in-addr.arpa

IN PTR

Response
DNS

55.36.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

55.36.223.20.in-addr.arpa

IN PTR

Response
DNS

55.36.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

55.36.223.20.in-addr.arpa

IN PTR

20.26.156.215:443

github.com

tls

7.4kB
115.9kB
73
113
20.26.156.215:443

github.com

tls

2.2kB
4.1kB
9
10
13.107.6.158:443

business.bing.com

tls

3.8kB
10.1kB
18
23
92.123.142.200:443

bzib.nelreports.net

tls

3.7kB
5.7kB
11
14
185.199.110.154:443

github.githubassets.com

tls

37.8kB
1.0MB
531
846
185.199.110.133:443

avatars.githubusercontent.com

tls

3.0kB
6.8kB
12
15
185.199.110.154:443

github.githubassets.com

tls

2.3kB
4.2kB
9
10
185.199.110.154:443

github.githubassets.com

tls

2.3kB
4.2kB
9
9
185.199.110.154:443

github.githubassets.com

tls

2.2kB
4.2kB
9
10
185.199.110.154:443

github.githubassets.com

tls

2.2kB
4.2kB
9
10
185.199.110.154:443

github.githubassets.com

tls

2.3kB
4.2kB
9
10
185.199.110.154:443

github.githubassets.com

tls

2.3kB
4.3kB
10
11
185.199.110.154:443

github.githubassets.com

tls

3.7kB
22.5kB
26
30
140.82.114.21:443

collector.github.com

tls

10.4kB
8.0kB
28
28
140.82.114.21:443

collector.github.com

tls

2.3kB
4.6kB
11
9
20.26.156.210:443

api.github.com

tls

10.7kB
6.7kB
24
22
51.11.108.188:443

nav-edge.smartscreen.microsoft.com

tls

27.8kB
624.2kB
319
470
20.26.156.216:443

codeload.github.com

tls

66.0kB
3.2MB
1336
2324

8.8.8.8:53

github.com

dns

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.26.156.215
8.8.8.8:53

github.com

dns

56 B
121 B
1
1

DNS Request

github.com
8.8.8.8:53

github.com

dns

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.26.156.215
8.8.8.8:53

business.bing.com

dns

63 B
144 B
1
1

DNS Request

business.bing.com

DNS Response

13.107.6.158
8.8.8.8:53

business.bing.com

dns

63 B
171 B
1
1

DNS Request

business.bing.com
8.8.8.8:53

bzib.nelreports.net

dns

65 B
172 B
1
1

DNS Request

bzib.nelreports.net

DNS Response

92.123.142.200

92.123.140.42
8.8.8.8:53

bzib.nelreports.net

dns

65 B
204 B
1
1

DNS Request

bzib.nelreports.net
8.8.8.8:53

github.githubassets.com

dns

69 B
133 B
1
1

DNS Request

github.githubassets.com

DNS Response

185.199.110.154

185.199.111.154

185.199.109.154

185.199.108.154
8.8.8.8:53

github.githubassets.com

dns

69 B
134 B
1
1

DNS Request

github.githubassets.com
8.8.8.8:53

avatars.githubusercontent.com

dns

75 B
139 B
1
1

DNS Request

avatars.githubusercontent.com

DNS Response

185.199.110.133

185.199.111.133

185.199.108.133

185.199.109.133
8.8.8.8:53

avatars.githubusercontent.com

dns

75 B
140 B
1
1

DNS Request

avatars.githubusercontent.com
8.8.8.8:53

user-images.githubusercontent.com

dns

79 B
143 B
1
1

DNS Request

user-images.githubusercontent.com

DNS Response

185.199.108.133

185.199.111.133

185.199.109.133

185.199.110.133
8.8.8.8:53

user-images.githubusercontent.com

dns

79 B
144 B
1
1

DNS Request

user-images.githubusercontent.com
8.8.8.8:53

github-cloud.s3.amazonaws.com

dns

75 B
253 B
1
1

DNS Request

github-cloud.s3.amazonaws.com

DNS Response

54.231.231.25

54.231.132.113

3.5.28.51

52.216.10.179

3.5.27.189

3.5.29.51

3.5.10.168

52.216.42.201
8.8.8.8:53

github-cloud.s3.amazonaws.com

dns

75 B
203 B
1
1

DNS Request

github-cloud.s3.amazonaws.com
8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

215.156.26.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

215.156.26.20.in-addr.arpa
8.8.8.8:53

64.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

64.159.190.20.in-addr.arpa
8.8.8.8:53

200.142.123.92.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

200.142.123.92.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

228.249.119.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

228.249.119.40.in-addr.arpa
8.8.8.8:53

nav-edge.smartscreen.microsoft.com

dns

80 B
1

DNS Request

nav-edge.smartscreen.microsoft.com
8.8.8.8:53

nav-edge.smartscreen.microsoft.com

dns

80 B
241 B
1
1

DNS Request

nav-edge.smartscreen.microsoft.com
95.101.129.233:443

www.bing.com

https

8.9kB
654.4kB
100
518
8.8.8.8:53

collector.github.com

dns

66 B
115 B
1
1

DNS Request

collector.github.com

DNS Response

140.82.114.21
8.8.8.8:53

collector.github.com

dns

66 B
164 B
1
1

DNS Request

collector.github.com
8.8.8.8:53

api.github.com

dns

60 B
76 B
1
1

DNS Request

api.github.com

DNS Response

20.26.156.210
8.8.8.8:53

api.github.com

dns

60 B
144 B
1
1

DNS Request

api.github.com
8.8.8.8:53

154.110.199.185.in-addr.arpa

dns

74 B
118 B
1
1

DNS Request

154.110.199.185.in-addr.arpa
8.8.8.8:53

133.110.199.185.in-addr.arpa

dns

74 B
118 B
1
1

DNS Request

133.110.199.185.in-addr.arpa
8.8.8.8:53

233.129.101.95.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

233.129.101.95.in-addr.arpa
8.8.8.8:53

73.144.22.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

73.144.22.2.in-addr.arpa
8.8.8.8:53

nav-edge.smartscreen.microsoft.com

dns

80 B
197 B
1
1

DNS Request

nav-edge.smartscreen.microsoft.com

DNS Response

51.11.108.188
8.8.8.8:53

data-edge.smartscreen.microsoft.com

dns

81 B
198 B
1
1

DNS Request

data-edge.smartscreen.microsoft.com

DNS Response

51.11.108.188
8.8.8.8:53

data-edge.smartscreen.microsoft.com

dns

81 B
243 B
1
1

DNS Request

data-edge.smartscreen.microsoft.com
8.8.8.8:53

21.114.82.140.in-addr.arpa

dns

72 B
117 B
1
1

DNS Request

21.114.82.140.in-addr.arpa
8.8.8.8:53

210.156.26.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

210.156.26.20.in-addr.arpa
8.8.8.8:53

188.108.11.51.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

188.108.11.51.in-addr.arpa
8.8.8.8:53

github.com

dns

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.26.156.215
8.8.8.8:53

github.com

dns

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.26.156.215
8.8.8.8:53

codeload.github.com

dns

65 B
81 B
1
1

DNS Request

codeload.github.com

DNS Response

20.26.156.216
8.8.8.8:53

codeload.github.com

dns

65 B
81 B
1
1

DNS Request

codeload.github.com

DNS Response

20.26.156.216
8.8.8.8:53

codeload.github.com

dns

65 B
130 B
1
1

DNS Request

codeload.github.com
8.8.8.8:53

217.106.137.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

217.106.137.52.in-addr.arpa
8.8.8.8:53

dl-edge.smartscreen.microsoft.com

dns

79 B
196 B
1
1

DNS Request

dl-edge.smartscreen.microsoft.com

DNS Response

51.11.108.188
8.8.8.8:53

dl-edge.smartscreen.microsoft.com

dns

79 B
240 B
1
1

DNS Request

dl-edge.smartscreen.microsoft.com
8.8.8.8:53

216.156.26.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

216.156.26.20.in-addr.arpa
224.0.0.251:5353

204 B
3
8.8.8.8:53

26.165.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

26.165.165.52.in-addr.arpa
8.8.8.8:53

15.164.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

15.164.165.52.in-addr.arpa
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

14.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

14.227.111.52.in-addr.arpa
8.8.8.8:53

55.36.223.20.in-addr.arpa

dns

142 B
157 B
2
1

DNS Request

55.36.223.20.in-addr.arpa

DNS Request

55.36.223.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4640-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4640-6-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads