Analysis

  • max time kernel
    299s
  • max time network
    288s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2024 16:02

General

  • Target

    TRISHA+ORGANIZER.zip

  • Size

    65.7MB

  • MD5

    96ed480f56cdb3acd81ab8b838f08608

  • SHA1

    3055effdddeed07769fb278f55b234cc5ea6ac0e

  • SHA256

    33fb8b0d61a1c2a7226ab510525cd928194bfc3a7903e381bfa19510a7396578

  • SHA512

    0179121ac8dfd61c50c9ddb91f7df8b29e913d70ccdbdb01ce5b8670f1ea28d50c1debec897cb3efa60009a310857eb4ac2df482af3c6643de39b965a52f6aee

  • SSDEEP

    1572864:/aSHlwFRflVhjNR/D3kQGA/SHsEO5Z8jUsk6qlvvoePof:/aU6l/hR/D3kbMEMusNwUk

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

privmerkt.com:8922

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-LAI9XP

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\TRISHA+ORGANIZER.zip
    1⤵
      PID:2252
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4712
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\TRISHA+ORGANIZER\" -spe -an -ai#7zMap28603:112:7zEvent1143
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2872
      • C:\Users\Admin\AppData\Local\Temp\TRISHA+ORGANIZER\2023 TRISHA ORGANIZERpdf.exe
        "C:\Users\Admin\AppData\Local\Temp\TRISHA+ORGANIZER\2023 TRISHA ORGANIZERpdf.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3640
        • C:\Users\Admin\AppData\Local\Temp\TRISHA+ORGANIZER\2023 TRISHA ORGANIZERpdf.exe
          "C:\Users\Admin\AppData\Local\Temp\TRISHA+ORGANIZER\2023 TRISHA ORGANIZERpdf.exe"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:832
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f & exit
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3256
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*UpdaterCisco" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\CiscoUpdater000_PARTIAL.dll",EntryPoint /f
            3⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:892

      Network

      • flag-us
        DNS
        104.219.191.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.219.191.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        104.219.191.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.219.191.52.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        2.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        2.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        58.55.71.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        58.55.71.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        133.211.185.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.211.185.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        133.211.185.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.211.185.52.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        133.211.185.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.211.185.52.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        privmerkt.com
        2023 TRISHA ORGANIZERpdf.exe
        Remote address:
        8.8.8.8:53
        Request
        privmerkt.com
        IN A
        Response
        privmerkt.com
        IN A
        172.111.244.3
      • flag-us
        DNS
        privmerkt.com
        2023 TRISHA ORGANIZERpdf.exe
        Remote address:
        8.8.8.8:53
        Request
        privmerkt.com
        IN A
      • flag-us
        DNS
        privmerkt.com
        2023 TRISHA ORGANIZERpdf.exe
        Remote address:
        8.8.8.8:53
        Request
        privmerkt.com
        IN A
      • flag-us
        DNS
        privmerkt.com
        2023 TRISHA ORGANIZERpdf.exe
        Remote address:
        8.8.8.8:53
        Request
        privmerkt.com
        IN A
      • flag-us
        DNS
        privmerkt.com
        2023 TRISHA ORGANIZERpdf.exe
        Remote address:
        8.8.8.8:53
        Request
        privmerkt.com
        IN A
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        56.126.166.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        56.126.166.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        3.244.111.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        3.244.111.172.in-addr.arpa
        IN PTR
        Response
        3.244.111.172.in-addr.arpa
        IN PTR
        ns645dnspurecom
      • flag-us
        DNS
        3.244.111.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        3.244.111.172.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        3.244.111.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        3.244.111.172.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        3.244.111.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        3.244.111.172.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        3.244.111.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        3.244.111.172.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
        Response
        18.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-18deploystaticakamaitechnologiescom
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        233.143.123.92.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        233.143.123.92.in-addr.arpa
        IN PTR
        Response
        233.143.123.92.in-addr.arpa
        IN PTR
        a92-123-143-233deploystaticakamaitechnologiescom
      • flag-us
        DNS
        11.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        11.227.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        25.140.123.92.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        25.140.123.92.in-addr.arpa
        IN PTR
        Response
        25.140.123.92.in-addr.arpa
        IN PTR
        a92-123-140-25deploystaticakamaitechnologiescom
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        716 B
        92 B
        5
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        1.0kB
        172 B
        8
        4
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        460 B
        88 B
        6
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        2.0kB
        52 B
        12
        1
      • 52.111.229.43:443
        322 B
        7
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        510 B
        92 B
        4
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        1.6kB
        52 B
        10
        1
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        1.6kB
        52 B
        10
        1
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        356 B
        92 B
        4
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        1.6kB
        52 B
        10
        1
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        716 B
        92 B
        5
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        716 B
        92 B
        5
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        1.6kB
        52 B
        10
        1
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        304 B
        92 B
        3
        2
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        396 B
        132 B
        5
        3
      • 172.111.244.3:8922
        privmerkt.com
        tls
        2023 TRISHA ORGANIZERpdf.exe
        1.1kB
        52 B
        7
        1
      • 8.8.8.8:53
        104.219.191.52.in-addr.arpa
        dns
        146 B
        147 B
        2
        1

        DNS Request

        104.219.191.52.in-addr.arpa

        DNS Request

        104.219.191.52.in-addr.arpa

      • 8.8.8.8:53
        172.214.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.214.232.199.in-addr.arpa

      • 8.8.8.8:53
        2.159.190.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        2.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        58.55.71.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        58.55.71.13.in-addr.arpa

      • 8.8.8.8:53
        133.211.185.52.in-addr.arpa
        dns
        219 B
        147 B
        3
        1

        DNS Request

        133.211.185.52.in-addr.arpa

        DNS Request

        133.211.185.52.in-addr.arpa

        DNS Request

        133.211.185.52.in-addr.arpa

      • 8.8.8.8:53
        privmerkt.com
        dns
        2023 TRISHA ORGANIZERpdf.exe
        295 B
        75 B
        5
        1

        DNS Request

        privmerkt.com

        DNS Request

        privmerkt.com

        DNS Request

        privmerkt.com

        DNS Request

        privmerkt.com

        DNS Request

        privmerkt.com

        DNS Response

        172.111.244.3

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        140 B
        156 B
        2
        1

        DNS Request

        50.23.12.20.in-addr.arpa

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        56.126.166.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        56.126.166.20.in-addr.arpa

      • 8.8.8.8:53
        3.244.111.172.in-addr.arpa
        dns
        360 B
        103 B
        5
        1

        DNS Request

        3.244.111.172.in-addr.arpa

        DNS Request

        3.244.111.172.in-addr.arpa

        DNS Request

        3.244.111.172.in-addr.arpa

        DNS Request

        3.244.111.172.in-addr.arpa

        DNS Request

        3.244.111.172.in-addr.arpa

      • 8.8.8.8:53
        18.134.221.88.in-addr.arpa
        dns
        216 B
        137 B
        3
        1

        DNS Request

        18.134.221.88.in-addr.arpa

        DNS Request

        18.134.221.88.in-addr.arpa

        DNS Request

        18.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        233.143.123.92.in-addr.arpa
        dns
        73 B
        139 B
        1
        1

        DNS Request

        233.143.123.92.in-addr.arpa

      • 8.8.8.8:53
        11.227.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        11.227.111.52.in-addr.arpa

      • 8.8.8.8:53
        25.140.123.92.in-addr.arpa
        dns
        72 B
        137 B
        1
        1

        DNS Request

        25.140.123.92.in-addr.arpa

      • 8.8.8.8:53

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\TRISHA+ORGANIZER\2023 TRISHA ORGANIZERpdf.exe

        Filesize

        6.1MB

        MD5

        4864a55cff27f686023456a22371e790

        SHA1

        6ed30c0371fe167d38411bfa6d720fcdcacc4f4c

        SHA256

        08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2

        SHA512

        4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb

      • C:\Users\Admin\AppData\Local\Temp\TRISHA+ORGANIZER\msimg32.dll

        Filesize

        6.3MB

        MD5

        6c1d68c7960415c632429da5aa258062

        SHA1

        c4de42e1b1de043c1a4224eacbd429d4fbef5764

        SHA256

        5b9c3d8a7377aa103f13a12bbd81f9d833de987e1a39da3d1b30ef4a30437cfa

        SHA512

        5d3b250636bc6ee96f4b3329a29d0d4b7cbebbcf7f7ed325725b2cbd9830d51f843b472b55f5c34845f90c69fe7f80e803e44b0142df443ab5c53b2af4805e86

      • memory/832-48-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-50-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-21-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-16-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-49-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-24-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-26-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-27-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-28-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-29-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-30-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-31-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-32-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-33-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-34-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-35-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-36-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-37-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-38-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-39-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-40-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-41-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-42-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-43-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-44-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-45-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-46-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-47-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-74-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-25-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-23-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-51-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-52-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-53-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-54-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-55-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-56-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-57-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-58-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-59-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-60-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-61-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-62-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-63-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-64-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-65-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-66-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-67-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-68-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-69-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-70-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-71-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-72-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/832-73-0x0000000000A30000-0x0000000000AB2000-memory.dmp

        Filesize

        520KB

      • memory/3640-15-0x0000000010000000-0x0000000010653000-memory.dmp

        Filesize

        6.3MB

      • memory/3640-11-0x0000000010000000-0x0000000010653000-memory.dmp

        Filesize

        6.3MB

      • memory/3640-13-0x0000000010000000-0x0000000010653000-memory.dmp

        Filesize

        6.3MB

      • memory/3640-10-0x0000000010000000-0x0000000010653000-memory.dmp

        Filesize

        6.3MB

      • memory/3640-17-0x0000000010000000-0x0000000010653000-memory.dmp

        Filesize

        6.3MB

      • memory/3640-19-0x0000000010000000-0x0000000010653000-memory.dmp

        Filesize

        6.3MB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.