Overview

overview

10

Static

static

3

1805de617e...32.exe

windows7-x64

10

1805de617e...32.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 19:02 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe

  • Size

    672KB

  • MD5

    c53e7c7ff6d7f49019e174eadc08893f

  • SHA1

    31dba8784e97f4980bfb9e5815878e3faf590d37

  • SHA256

    1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32

  • SHA512

    2acab93f9da5a97ac466255240750629a151cc353c53543cac9732ab0cbfd3efe57f331199e648d2d521f969de0ca2549ead7335e7b452c58c4239869898525b

  • SSDEEP

    12288:CKi31T9NjhSEt6qHqYbCTd2f5Pg5jeBBJum7N5Z:7i399thS8MYQsfpW+um7NT

Score
10/10
snakekeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
    "C:\Users\Admin\AppData\Local\Temp\1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2296
    • C:\Users\Admin\AppData\Local\Temp\1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
      "C:\Users\Admin\AppData\Local\Temp\1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe"
      2⤵
        PID:3240
      • C:\Users\Admin\AppData\Local\Temp\1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
        "C:\Users\Admin\AppData\Local\Temp\1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe"
        2⤵
          PID:1956
        • C:\Users\Admin\AppData\Local\Temp\1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          "C:\Users\Admin\AppData\Local\Temp\1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe"
          2⤵
            PID:468
          • C:\Users\Admin\AppData\Local\Temp\1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
            "C:\Users\Admin\AppData\Local\Temp\1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe"
            2⤵
            • Accesses Microsoft Outlook profiles
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:3760

        Network

        • flag-us
          DNS
          217.106.137.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          217.106.137.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          172.210.232.199.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          172.210.232.199.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          0.159.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          0.159.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          checkip.dyndns.org
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          8.8.8.8:53
          Request
          checkip.dyndns.org
          IN A
          Response
          checkip.dyndns.org
          IN CNAME
          checkip.dyndns.com
          checkip.dyndns.com
          IN A
          158.101.44.242
          checkip.dyndns.com
          IN A
          193.122.6.168
          checkip.dyndns.com
          IN A
          132.226.8.169
          checkip.dyndns.com
          IN A
          193.122.130.0
          checkip.dyndns.com
          IN A
          132.226.247.73
        • flag-us
          GET
          http://checkip.dyndns.org/
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          158.101.44.242:80
          Request
          GET / HTTP/1.1
          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
          Host: checkip.dyndns.org
          Connection: Keep-Alive
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:18 GMT
          Content-Type: text/html
          Content-Length: 105
          Connection: keep-alive
          Cache-Control: no-cache
          Pragma: no-cache
          X-Request-ID: acd82f9971520d8c2f91cffef179b098
        • flag-us
          GET
          http://checkip.dyndns.org/
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          158.101.44.242:80
          Request
          GET / HTTP/1.1
          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
          Host: checkip.dyndns.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:18 GMT
          Content-Type: text/html
          Content-Length: 105
          Connection: keep-alive
          Cache-Control: no-cache
          Pragma: no-cache
          X-Request-ID: 785dfb14ce9ae578b549d9b22d58609b
        • flag-us
          GET
          http://checkip.dyndns.org/
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          158.101.44.242:80
          Request
          GET / HTTP/1.1
          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
          Host: checkip.dyndns.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:19 GMT
          Content-Type: text/html
          Content-Length: 105
          Connection: keep-alive
          Cache-Control: no-cache
          Pragma: no-cache
          X-Request-ID: c60a8a48d374b3d8ce5b8eb2edd7c07f
        • flag-us
          GET
          http://checkip.dyndns.org/
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          158.101.44.242:80
          Request
          GET / HTTP/1.1
          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
          Host: checkip.dyndns.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:19 GMT
          Content-Type: text/html
          Content-Length: 105
          Connection: keep-alive
          Cache-Control: no-cache
          Pragma: no-cache
          X-Request-ID: ae8aac215082cfb925ce492b0444cfb9
        • flag-us
          GET
          http://checkip.dyndns.org/
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          158.101.44.242:80
          Request
          GET / HTTP/1.1
          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
          Host: checkip.dyndns.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:19 GMT
          Content-Type: text/html
          Content-Length: 105
          Connection: keep-alive
          Cache-Control: no-cache
          Pragma: no-cache
          X-Request-ID: 57cbfdbc9406b911db9e7db622426e97
        • flag-us
          GET
          http://checkip.dyndns.org/
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          158.101.44.242:80
          Request
          GET / HTTP/1.1
          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
          Host: checkip.dyndns.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:20 GMT
          Content-Type: text/html
          Content-Length: 105
          Connection: keep-alive
          Cache-Control: no-cache
          Pragma: no-cache
          X-Request-ID: 4844f645cde88c810ca1a2efffec0bf0
        • flag-us
          GET
          http://checkip.dyndns.org/
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          158.101.44.242:80
          Request
          GET / HTTP/1.1
          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
          Host: checkip.dyndns.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:20 GMT
          Content-Type: text/html
          Content-Length: 105
          Connection: keep-alive
          Cache-Control: no-cache
          Pragma: no-cache
          X-Request-ID: a70ecff75081b93fedc66219ea436d19
        • flag-us
          GET
          http://checkip.dyndns.org/
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          158.101.44.242:80
          Request
          GET / HTTP/1.1
          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
          Host: checkip.dyndns.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:20 GMT
          Content-Type: text/html
          Content-Length: 105
          Connection: keep-alive
          Cache-Control: no-cache
          Pragma: no-cache
          X-Request-ID: 1428fd1a9273d1480ef7f2a3a1515cfb
        • flag-us
          GET
          http://checkip.dyndns.org/
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          158.101.44.242:80
          Request
          GET / HTTP/1.1
          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
          Host: checkip.dyndns.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:20 GMT
          Content-Type: text/html
          Content-Length: 105
          Connection: keep-alive
          Cache-Control: no-cache
          Pragma: no-cache
          X-Request-ID: 3aa19e961c52cdb5466c564a5e6ef410
        • flag-us
          DNS
          242.44.101.158.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          242.44.101.158.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          reallyfreegeoip.org
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          8.8.8.8:53
          Request
          reallyfreegeoip.org
          IN A
          Response
          reallyfreegeoip.org
          IN A
          104.21.67.152
          reallyfreegeoip.org
          IN A
          172.67.177.134
        • flag-us
          GET
          https://reallyfreegeoip.org/xml/138.199.29.44
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          104.21.67.152:443
          Request
          GET /xml/138.199.29.44 HTTP/1.1
          Host: reallyfreegeoip.org
          Connection: Keep-Alive
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:19 GMT
          Content-Type: application/xml
          Transfer-Encoding: chunked
          Connection: keep-alive
          access-control-allow-origin: *
          vary: Accept-Encoding
          Cache-Control: max-age=86400
          CF-Cache-Status: HIT
          Age: 17088
          Last-Modified: Sat, 05 Oct 2024 14:18:31 GMT
          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sNmjOF2dxtsQdTFoEgcbHMiI1zLlA0BOH5BAVr7HgMNCVY5LwHJIRLNmUYbkrTBwYeezqK9M6aRiqyoj4jSxplfIkfXkrt8dWrxcKU2dNPqX5vHfIcXBS5cXZl6eu6MsOZsRJPgz"}],"group":"cf-nel","max_age":604800}
          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
          Server: cloudflare
          CF-RAY: 8cdfabc90c046409-LHR
        • flag-us
          GET
          https://reallyfreegeoip.org/xml/138.199.29.44
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          104.21.67.152:443
          Request
          GET /xml/138.199.29.44 HTTP/1.1
          Host: reallyfreegeoip.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:19 GMT
          Content-Type: application/xml
          Transfer-Encoding: chunked
          Connection: keep-alive
          access-control-allow-origin: *
          vary: Accept-Encoding
          Cache-Control: max-age=86400
          CF-Cache-Status: HIT
          Age: 17088
          Last-Modified: Sat, 05 Oct 2024 14:18:31 GMT
          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lLFp49QIsgJ5H9lWlptue1N%2FpsOw%2BTx7vqrbkhU9ReqCY0apRC6eDrhA6gdl0HOyIgJzWo5ENjdkDXTm14Zz1frPPOSqADkm3KAAWb7AhCZ0AA6mn%2FUgEQHtwnR6TbHr2Icj7AU9"}],"group":"cf-nel","max_age":604800}
          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
          Server: cloudflare
          CF-RAY: 8cdfabcaaefe6409-LHR
        • flag-us
          GET
          https://reallyfreegeoip.org/xml/138.199.29.44
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          104.21.67.152:443
          Request
          GET /xml/138.199.29.44 HTTP/1.1
          Host: reallyfreegeoip.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:19 GMT
          Content-Type: application/xml
          Transfer-Encoding: chunked
          Connection: keep-alive
          access-control-allow-origin: *
          vary: Accept-Encoding
          Cache-Control: max-age=86400
          CF-Cache-Status: HIT
          Age: 17088
          Last-Modified: Sat, 05 Oct 2024 14:18:31 GMT
          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iHtYjL%2F5ElAVjOULL%2F1iK6N2VzbXEy0j7bpNzwWWfLnEzuL3MvcZsn5IEGNOdbJe4pkvWOSmBJgAQIOv8mIlfExitBRl9mgisw5ONyGxuslgjtnQ%2FBa1oPPZivJifUUH2oUfC5ph"}],"group":"cf-nel","max_age":604800}
          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
          Server: cloudflare
          CF-RAY: 8cdfabcc29626409-LHR
        • flag-us
          GET
          https://reallyfreegeoip.org/xml/138.199.29.44
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          104.21.67.152:443
          Request
          GET /xml/138.199.29.44 HTTP/1.1
          Host: reallyfreegeoip.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:19 GMT
          Content-Type: application/xml
          Transfer-Encoding: chunked
          Connection: keep-alive
          access-control-allow-origin: *
          vary: Accept-Encoding
          Cache-Control: max-age=86400
          CF-Cache-Status: HIT
          Age: 17088
          Last-Modified: Sat, 05 Oct 2024 14:18:31 GMT
          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xHe3bjN23lLGkKhDgP9c%2FbN3A53KVU3H3ubWKgHgDqtJvubjwR9dwLRGZK3rKb4qgAmR8EYN1MJaCYCaCPUFrsw6PcqBEG1S7vOeTKr%2B7oqxFK8%2BXDbEl2%2FcGrM0sB6YNWu0s%2Fcr"}],"group":"cf-nel","max_age":604800}
          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
          Server: cloudflare
          CF-RAY: 8cdfabcd9c076409-LHR
        • flag-us
          GET
          https://reallyfreegeoip.org/xml/138.199.29.44
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          104.21.67.152:443
          Request
          GET /xml/138.199.29.44 HTTP/1.1
          Host: reallyfreegeoip.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:20 GMT
          Content-Type: application/xml
          Transfer-Encoding: chunked
          Connection: keep-alive
          access-control-allow-origin: *
          vary: Accept-Encoding
          Cache-Control: max-age=86400
          CF-Cache-Status: HIT
          Age: 17089
          Last-Modified: Sat, 05 Oct 2024 14:18:31 GMT
          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BXl2XOESB1sTLmmkojj13domKISI4V84%2FEFjhvzTnZNhy2hJ%2FGei8mMLySXTh8I8htREQwZavZ%2F261DpC%2BhqLgIjE99owJmOR74E%2FTkdCXn1Lzw5sLEMwwkZdJpJ7lXNYZuxY4XJ"}],"group":"cf-nel","max_age":604800}
          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
          Server: cloudflare
          CF-RAY: 8cdfabcf0dfa6409-LHR
        • flag-us
          GET
          https://reallyfreegeoip.org/xml/138.199.29.44
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          104.21.67.152:443
          Request
          GET /xml/138.199.29.44 HTTP/1.1
          Host: reallyfreegeoip.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:20 GMT
          Content-Type: application/xml
          Transfer-Encoding: chunked
          Connection: keep-alive
          access-control-allow-origin: *
          vary: Accept-Encoding
          Cache-Control: max-age=86400
          CF-Cache-Status: HIT
          Age: 17089
          Last-Modified: Sat, 05 Oct 2024 14:18:31 GMT
          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dc%2By5j8%2BPSid981MYB1H226G6UfBfbBtKZbPqqdRPz60EoW1CT7DsDJa3LF3jZe0j2Ars4Ll2VBTtomuDFx6EosYzX8XcowZu5Otr3eu1FXQ9nxTkBJYnXcJPoI%2BJaBGoJFDYEKY"}],"group":"cf-nel","max_age":604800}
          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
          Server: cloudflare
          CF-RAY: 8cdfabd07fdd6409-LHR
        • flag-us
          GET
          https://reallyfreegeoip.org/xml/138.199.29.44
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          104.21.67.152:443
          Request
          GET /xml/138.199.29.44 HTTP/1.1
          Host: reallyfreegeoip.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:20 GMT
          Content-Type: application/xml
          Transfer-Encoding: chunked
          Connection: keep-alive
          access-control-allow-origin: *
          vary: Accept-Encoding
          Cache-Control: max-age=86400
          CF-Cache-Status: HIT
          Age: 17089
          Last-Modified: Sat, 05 Oct 2024 14:18:31 GMT
          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BVlh%2FRMHdJVWT1JdYmehh8l%2FKYajTYygqduLaEMtS01DenEJQSR4UcE24Dnn32u0UC%2BswsgYpQGerKm9V3GsOia4QIlyhyMoOQ8rZnbpevVPF76ftqwq00tbKPtuhhdjlfcMlN2T"}],"group":"cf-nel","max_age":604800}
          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
          Server: cloudflare
          CF-RAY: 8cdfabd26a5d6409-LHR
        • flag-us
          GET
          https://reallyfreegeoip.org/xml/138.199.29.44
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          Remote address:
          104.21.67.152:443
          Request
          GET /xml/138.199.29.44 HTTP/1.1
          Host: reallyfreegeoip.org
          Response
          HTTP/1.1 200 OK
          Date: Sat, 05 Oct 2024 19:03:21 GMT
          Content-Type: application/xml
          Transfer-Encoding: chunked
          Connection: keep-alive
          access-control-allow-origin: *
          vary: Accept-Encoding
          Cache-Control: max-age=86400
          CF-Cache-Status: HIT
          Age: 17090
          Last-Modified: Sat, 05 Oct 2024 14:18:31 GMT
          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dRySjgkowu3%2BDncLcBkyh%2BPuu%2Fe8hblWtU99Aimh%2B4Y%2Fgm9J90fxI0qNRd%2BmFbgrxJ6jdKiseI4vQ2NIA9%2BpaJD41Z3xkP%2FESHRd1N7zKZEiuSs9wWcCwUD5DFXxfiDDMBKo1%2Byi"}],"group":"cf-nel","max_age":604800}
          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
          Server: cloudflare
          CF-RAY: 8cdfabd4cd766409-LHR
        • flag-us
          DNS
          152.67.21.104.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          152.67.21.104.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          104.219.191.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          104.219.191.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          197.87.175.4.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          197.87.175.4.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          241.42.69.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          241.42.69.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          232.168.11.51.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          232.168.11.51.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          240.221.184.93.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          240.221.184.93.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          69.190.18.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          69.190.18.2.in-addr.arpa
          IN PTR
          Response
          69.190.18.2.in-addr.arpa
          IN PTR
          a2-18-190-69deploystaticakamaitechnologiescom
        • flag-us
          DNS
          79.190.18.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          79.190.18.2.in-addr.arpa
          IN PTR
          Response
          79.190.18.2.in-addr.arpa
          IN PTR
          a2-18-190-79deploystaticakamaitechnologiescom
        • flag-us
          DNS
          13.227.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          13.227.111.52.in-addr.arpa
          IN PTR
          Response
        • 158.101.44.242:80
          http://checkip.dyndns.org/
          http
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          2.2kB
           3.5kB
           23
          16

          HTTP Request

          GET http://checkip.dyndns.org/

          HTTP Response

          200

          HTTP Request

          GET http://checkip.dyndns.org/

          HTTP Response

          200

          HTTP Request

          GET http://checkip.dyndns.org/

          HTTP Response

          200

          HTTP Request

          GET http://checkip.dyndns.org/

          HTTP Response

          200

          HTTP Request

          GET http://checkip.dyndns.org/

          HTTP Response

          200

          HTTP Request

          GET http://checkip.dyndns.org/

          HTTP Response

          200

          HTTP Request

          GET http://checkip.dyndns.org/

          HTTP Response

          200

          HTTP Request

          GET http://checkip.dyndns.org/

          HTTP Response

          200

          HTTP Request

          GET http://checkip.dyndns.org/

          HTTP Response

          200
        • 104.21.67.152:443
          https://reallyfreegeoip.org/xml/138.199.29.44
          tls, http
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          2.0kB
           12.4kB
           23
          23

          HTTP Request

          GET https://reallyfreegeoip.org/xml/138.199.29.44

          HTTP Response

          200

          HTTP Request

          GET https://reallyfreegeoip.org/xml/138.199.29.44

          HTTP Response

          200

          HTTP Request

          GET https://reallyfreegeoip.org/xml/138.199.29.44

          HTTP Response

          200

          HTTP Request

          GET https://reallyfreegeoip.org/xml/138.199.29.44

          HTTP Response

          200

          HTTP Request

          GET https://reallyfreegeoip.org/xml/138.199.29.44

          HTTP Response

          200

          HTTP Request

          GET https://reallyfreegeoip.org/xml/138.199.29.44

          HTTP Response

          200

          HTTP Request

          GET https://reallyfreegeoip.org/xml/138.199.29.44

          HTTP Response

          200

          HTTP Request

          GET https://reallyfreegeoip.org/xml/138.199.29.44

          HTTP Response

          200
        • 8.8.8.8:53
          217.106.137.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          217.106.137.52.in-addr.arpa

        • 8.8.8.8:53
          172.210.232.199.in-addr.arpa
          dns
          74 B
           128 B
           1
          1

          DNS Request

          172.210.232.199.in-addr.arpa

        • 8.8.8.8:53
          0.159.190.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          0.159.190.20.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          checkip.dyndns.org
          dns
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          64 B
           176 B
           1
          1

          DNS Request

          checkip.dyndns.org

          DNS Response

          158.101.44.242
          193.122.6.168
          132.226.8.169
          193.122.130.0
          132.226.247.73

        • 8.8.8.8:53
          242.44.101.158.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          242.44.101.158.in-addr.arpa

        • 8.8.8.8:53
          reallyfreegeoip.org
          dns
          1805de617efd83d19a762f835ab979fba25070c2becdf125a64e2b45df15eb32.exe
          65 B
           97 B
           1
          1

          DNS Request

          reallyfreegeoip.org

          DNS Response

          104.21.67.152
          172.67.177.134

        • 8.8.8.8:53
          152.67.21.104.in-addr.arpa
          dns
          72 B
           134 B
           1
          1

          DNS Request

          152.67.21.104.in-addr.arpa

        • 8.8.8.8:53
          104.219.191.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          104.219.191.52.in-addr.arpa

        • 8.8.8.8:53
          197.87.175.4.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          197.87.175.4.in-addr.arpa

        • 8.8.8.8:53
          241.42.69.40.in-addr.arpa
          dns
          71 B
           145 B
           1
          1

          DNS Request

          241.42.69.40.in-addr.arpa

        • 8.8.8.8:53
          232.168.11.51.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          232.168.11.51.in-addr.arpa

        • 8.8.8.8:53
          240.221.184.93.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          240.221.184.93.in-addr.arpa

        • 8.8.8.8:53
          69.190.18.2.in-addr.arpa
          dns
          70 B
           133 B
           1
          1

          DNS Request

          69.190.18.2.in-addr.arpa

        • 8.8.8.8:53
          79.190.18.2.in-addr.arpa
          dns
          70 B
           133 B
           1
          1

          DNS Request

          79.190.18.2.in-addr.arpa

        • 8.8.8.8:53
          13.227.111.52.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          13.227.111.52.in-addr.arpa

        • 8.8.8.8:53

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kekttqat.5cn.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • memory/2296-48-0x00000000077C0000-0x00000000077DA000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2296-50-0x0000000007A40000-0x0000000007AD6000-memory.dmp

          Filesize

          600KB

          Download

        • memory/2296-58-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/2296-55-0x0000000007AE0000-0x0000000007AE8000-memory.dmp

          Filesize

          32KB

          Download

        • memory/2296-54-0x0000000007B00000-0x0000000007B1A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2296-53-0x0000000007A00000-0x0000000007A14000-memory.dmp

          Filesize

          80KB

          Download

        • memory/2296-52-0x00000000079F0000-0x00000000079FE000-memory.dmp

          Filesize

          56KB

          Download

        • memory/2296-51-0x00000000079C0000-0x00000000079D1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/2296-32-0x00000000064A0000-0x00000000064BE000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2296-49-0x0000000007830000-0x000000000783A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2296-47-0x0000000007E10000-0x000000000848A000-memory.dmp

          Filesize

          6.5MB

          Download

        • memory/2296-13-0x0000000002BB0000-0x0000000002BE6000-memory.dmp

          Filesize

          216KB

          Download

        • memory/2296-15-0x00000000056E0000-0x0000000005D08000-memory.dmp

          Filesize

          6.2MB

          Download

        • memory/2296-46-0x0000000007690000-0x0000000007733000-memory.dmp

          Filesize

          652KB

          Download

        • memory/2296-45-0x0000000006AC0000-0x0000000006ADE000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2296-17-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/2296-20-0x00000000054F0000-0x0000000005556000-memory.dmp

          Filesize

          408KB

          Download

        • memory/2296-19-0x0000000005480000-0x00000000054E6000-memory.dmp

          Filesize

          408KB

          Download

        • memory/2296-18-0x00000000053E0000-0x0000000005402000-memory.dmp

          Filesize

          136KB

          Download

        • memory/2296-35-0x0000000070BF0000-0x0000000070C3C000-memory.dmp

          Filesize

          304KB

          Download

        • memory/2296-34-0x0000000006A60000-0x0000000006A92000-memory.dmp

          Filesize

          200KB

          Download

        • memory/2296-33-0x0000000006530000-0x000000000657C000-memory.dmp

          Filesize

          304KB

          Download

        • memory/2296-30-0x0000000005E50000-0x00000000061A4000-memory.dmp

          Filesize

          3.3MB

          Download

        • memory/3760-31-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3760-61-0x0000000006620000-0x00000000067E2000-memory.dmp

          Filesize

          1.8MB

          Download

        • memory/3760-60-0x0000000006400000-0x0000000006450000-memory.dmp

          Filesize

          320KB

          Download

        • memory/3760-14-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3760-59-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/3760-11-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

          Download

        • memory/4328-8-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/4328-0-0x000000007531E000-0x000000007531F000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4328-10-0x000000000C570000-0x000000000C60C000-memory.dmp

          Filesize

          624KB

          Download

        • memory/4328-1-0x0000000000C30000-0x0000000000CDE000-memory.dmp

          Filesize

          696KB

          Download

        • memory/4328-7-0x000000007531E000-0x000000007531F000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4328-6-0x0000000006CF0000-0x0000000006D0E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/4328-5-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/4328-4-0x00000000056D0000-0x00000000056DA000-memory.dmp

          Filesize

          40KB

          Download

        • memory/4328-3-0x0000000005700000-0x0000000005792000-memory.dmp

          Filesize

          584KB

          Download

        • memory/4328-16-0x0000000075310000-0x0000000075AC0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/4328-9-0x00000000050D0000-0x0000000005138000-memory.dmp

          Filesize

          416KB

          Download

        • memory/4328-2-0x0000000005CB0000-0x0000000006254000-memory.dmp

          Filesize

          5.6MB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.