njrat | 925364c585429e6ae064c4db9c7bf30db036debed7b1f403efc60ea6990da4bf

Analysis

max time kernel
33s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 18:18 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EMANNN.exe
Size

55KB
MD5

6bc49cb82d9f92f4a70cf4c84265c26f
SHA1

87f69c48c84f9a701b6800762c69c95dfd181273
SHA256

925364c585429e6ae064c4db9c7bf30db036debed7b1f403efc60ea6990da4bf
SHA512

3d1f055ec378e244c239debc9832bbd6f56a1b3cb27fa009380a728e769ad870272d90cc940d269a3f985c333380b43eedb4c5d1fbe8be57bd67749bc9419d0c
SSDEEP

1536:k+mIDn/NOryWhI0DtwsNMDmXExI3pmjm:SIDnE+v0DtwsNMDmXExI3pm

Score

10^/10

njrat discovery persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Deletes itself 1 IoCs

pid	Process
2616	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f53a2de487461812859f1781af27b20d.exe	EMANNN.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f53a2de487461812859f1781af27b20d.exe	EMANNN.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\f53a2de487461812859f1781af27b20d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EMANNN.exe\" .."	EMANNN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f53a2de487461812859f1781af27b20d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EMANNN.exe\" .."	EMANNN.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMANNN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2616	cmd.exe
2744	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2744	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1928	chrome.exe
1928	chrome.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	320	EMANNN.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: 33	320	EMANNN.exe
Token: SeIncBasePriorityPrivilege	320	EMANNN.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: 33	320	EMANNN.exe
Token: SeIncBasePriorityPrivilege	320	EMANNN.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe
Token: SeShutdownPrivilege	1928	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe
1928	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1704	1928	chrome.exe	31
PID 1928 wrote to memory of 1704	1928	chrome.exe	31
PID 1928 wrote to memory of 1704	1928	chrome.exe	31
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2384	1928	chrome.exe	33
PID 1928 wrote to memory of 2652	1928	chrome.exe	34
PID 1928 wrote to memory of 2652	1928	chrome.exe	34
PID 1928 wrote to memory of 2652	1928	chrome.exe	34
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35
PID 1928 wrote to memory of 1624	1928	chrome.exe	35

C:\Users\Admin\AppData\Local\Temp\EMANNN.exe
"C:\Users\Admin\AppData\Local\Temp\EMANNN.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:320
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /delete /tn CleanSweepCheck /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\EMANNN.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2616
- - C:\Windows\SysWOW64\PING.EXE
    ping 0 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefaec9758,0x7fefaec9768,0x7fefaec9778
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2296 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1440 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:2
  2⤵
  PID:584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1432 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3324 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3080 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3628 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3852 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2824 --field-trial-handle=1332,i,9755490034395616860,6209982669773475762,131072 /prefetch:8
  2⤵
  PID:2556

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1572

Network

DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.200.36
GET

https://www.google.com/async/ddljson?async=ntp:2

chrome.exe

Remote address:

142.250.200.36:443

Request

GET /async/ddljson?async=ntp:2 HTTP/2.0
host: www.google.com
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

chrome.exe

Remote address:

142.250.200.36:443

Request

GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2.0
host: www.google.com
x-client-data: COPjygE=
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.google.com/async/newtab_promos

chrome.exe

Remote address:

142.250.200.36:443

Request

GET /async/newtab_promos HTTP/2.0
host: www.google.com
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

maps-having.gl.at.ply.gg

EMANNN.exe

Remote address:

8.8.8.8:53

Request

maps-having.gl.at.ply.gg

IN A

Response

maps-having.gl.at.ply.gg

IN A

147.185.221.18
DNS

ogads-pa.googleapis.com

chrome.exe

Remote address:

8.8.8.8:53

Request

ogads-pa.googleapis.com

IN A

Response

ogads-pa.googleapis.com

IN A

142.250.180.10

ogads-pa.googleapis.com

IN A

142.250.187.234

ogads-pa.googleapis.com

IN A

172.217.169.10

ogads-pa.googleapis.com

IN A

216.58.201.106

ogads-pa.googleapis.com

IN A

142.250.200.10

ogads-pa.googleapis.com

IN A

216.58.213.10

ogads-pa.googleapis.com

IN A

142.250.178.10

ogads-pa.googleapis.com

IN A

142.250.187.202

ogads-pa.googleapis.com

IN A

142.250.179.234

ogads-pa.googleapis.com

IN A

142.250.200.42

ogads-pa.googleapis.com

IN A

216.58.204.74

ogads-pa.googleapis.com

IN A

172.217.16.234
DNS

apis.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

apis.google.com

IN A

Response

apis.google.com

IN CNAME

plus.l.google.com

plus.l.google.com

IN A

142.250.200.46
OPTIONS

https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData

chrome.exe

Remote address:

142.250.180.10:443

Request

OPTIONS /$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData HTTP/2.0
host: ogads-pa.googleapis.com
accept: */*
access-control-request-method: POST
access-control-request-headers: content-type,x-goog-api-key,x-user-agent
origin: chrome-untrusted://new-tab-page
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.7LPvRDgzcqA.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo9wdgl3D0Cd5pn6O1gZXHwWDc_oTg/cb=gapi.loaded_0

chrome.exe

Remote address:

142.250.200.46:443

Request

GET /_/scs/abc-static/_/js/k=gapi.gapi.en.7LPvRDgzcqA.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo9wdgl3D0Cd5pn6O1gZXHwWDc_oTg/cb=gapi.loaded_0 HTTP/2.0
host: apis.google.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

play.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

play.google.com

IN A

Response

play.google.com

IN A

172.217.169.46
POST

https://play.google.com/log?format=json&hasfast=true

chrome.exe

Remote address:

172.217.169.46:443

Request

POST /log?format=json&hasfast=true HTTP/2.0
host: play.google.com
content-length: 1435
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-platform: "Windows"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
content-type: application/x-www-form-urlencoded;charset=UTF-8
accept: */*
origin: chrome-untrusted://new-tab-page
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

142.250.200.36:443

https://www.google.com/async/newtab_promos

tls, http2

chrome.exe

3.4kB
88.4kB
49
77

HTTP Request

GET https://www.google.com/async/ddljson?async=ntp:2

HTTP Request

GET https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

HTTP Request

GET https://www.google.com/async/newtab_promos
142.250.200.36:443

www.google.com

tls, http2

chrome.exe

999 B
5.6kB
9
9
142.250.200.36:443

www.google.com

tls, http2

chrome.exe

999 B
5.6kB
9
8
147.185.221.18:52531

maps-having.gl.at.ply.gg

EMANNN.exe

1.9kB
900 B
14
17
142.250.180.10:443

https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData

tls, http2

chrome.exe

1.8kB
6.8kB
15
16

HTTP Request

OPTIONS https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData
142.250.200.46:443

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.7LPvRDgzcqA.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo9wdgl3D0Cd5pn6O1gZXHwWDc_oTg/cb=gapi.loaded_0

tls, http2

chrome.exe

2.6kB
51.1kB
31
46

HTTP Request

GET https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.7LPvRDgzcqA.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo9wdgl3D0Cd5pn6O1gZXHwWDc_oTg/cb=gapi.loaded_0
172.217.169.46:443

https://play.google.com/log?format=json&hasfast=true

tls, http2

chrome.exe

3.4kB
9.2kB
17
20

HTTP Request

POST https://play.google.com/log?format=json&hasfast=true

8.8.8.8:53

www.google.com

dns

chrome.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.200.36
8.8.8.8:53

maps-having.gl.at.ply.gg

dns

EMANNN.exe

70 B
86 B
1
1

DNS Request

maps-having.gl.at.ply.gg

DNS Response

147.185.221.18
8.8.8.8:53

ogads-pa.googleapis.com

dns

chrome.exe

69 B
261 B
1
1

DNS Request

ogads-pa.googleapis.com

DNS Response

142.250.180.10

142.250.187.234

172.217.169.10

216.58.201.106

142.250.200.10

216.58.213.10

142.250.178.10

142.250.187.202

142.250.179.234

142.250.200.42

216.58.204.74

172.217.16.234
8.8.8.8:53

apis.google.com

dns

chrome.exe

61 B
98 B
1
1

DNS Request

apis.google.com

DNS Response

142.250.200.46
142.250.180.10:443

ogads-pa.googleapis.com

https

chrome.exe

3.7kB
7.1kB
9
11
8.8.8.8:53

play.google.com

dns

chrome.exe

61 B
77 B
1
1

DNS Request

play.google.com

DNS Response

172.217.169.46
224.0.0.251:5353

chrome.exe

204 B
3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
cd1bf169833e653c01c112e62d80fbe3

SHA1
018f04efb02b08e14c7774fe302312a641a52a3f

SHA256
db0a2d5d8d91c68069d0a1fc6d84c51ae94f04f9d625baef2f0c99b372a7af8e

SHA512
f8c25f8469b7b6c0d73f2aaa6d6df340691097b115804397b35b4787bcc7472f34b9b4b2a2c14a50df4eef88bbb95eb612bf7a787e4a2df1654536da03edabb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
7c2d093f7b2d834ec68ae000c4d5b6fd

SHA1
515040e2c1e0d13e0128a8c3e911350e8b507f06

SHA256
ffb92655a7f7b239a6ed6537925621130cfcf2e157175ef6e780fb26c74b0c72

SHA512
9ddec118b13470ab26f4e2646663a3de781a75ed52b3303826d7c7e0641314cd7b852683571fd424acf800c29f1fc60ca1a11433b2742dfdd9fbfc9237092b79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
memory/320-0-0x0000000074441000-0x0000000074442000-memory.dmp

Filesize
4KB

Download
memory/320-1-0x0000000074440000-0x00000000749EB000-memory.dmp

Filesize
5.7MB

Download
memory/320-2-0x0000000074440000-0x00000000749EB000-memory.dmp

Filesize
5.7MB

Download
memory/320-43-0x0000000074440000-0x00000000749EB000-memory.dmp

Filesize
5.7MB

Download
memory/320-56-0x0000000074440000-0x00000000749EB000-memory.dmp

Filesize
5.7MB

Download
memory/320-77-0x0000000074440000-0x00000000749EB000-memory.dmp

Filesize
5.7MB

Download
memory/320-96-0x0000000074440000-0x00000000749EB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.