Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2024, 22:14 UTC

General

  • Target

    5d324a3f2d5ce77ea1d7744d8f6adcb957f3291e320bea2762ef6d0c64feceeb.exe

  • Size

    1.4MB

  • MD5

    4deb18428ed78e7f7cd4b6aa4ab87564

  • SHA1

    cef63d12cfa738a9b1fff262d9a534ed9afbe403

  • SHA256

    5d324a3f2d5ce77ea1d7744d8f6adcb957f3291e320bea2762ef6d0c64feceeb

  • SHA512

    0054654ad4fc16da53c4fa2827f9b59bddf19ddfb4f16b4a6d4322b5006a089e1828e3d6da6a546aac75919cfec54bf9e1a98918fef82e39189aa0c75a521533

  • SSDEEP

    24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYL:Fo0c++OCokGs9Fa+rd1f26RNYL

Malware Config

Extracted

Family

netwire

C2

Wealthy2019.com.strangled.net:20190

wealthyme.ddns.net:20190

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    sunshineslisa

  • install_path

    %AppData%\Imgburn\Host.exe

  • keylogger_dir

    %AppData%\Logs\Imgburn\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    sucess

  • registry_autorun

    false

  • use_mutex

    false

Extracted

Family

warzonerat

C2

wealth.warzonedns.com:5202

Signatures

  • NetWire RAT payload 13 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 3 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d324a3f2d5ce77ea1d7744d8f6adcb957f3291e320bea2762ef6d0c64feceeb.exe
    "C:\Users\Admin\AppData\Local\Temp\5d324a3f2d5ce77ea1d7744d8f6adcb957f3291e320bea2762ef6d0c64feceeb.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:944
    • C:\Users\Admin\AppData\Roaming\Blasthost.exe
      "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
        "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1920
    • C:\Users\Admin\AppData\Local\Temp\5d324a3f2d5ce77ea1d7744d8f6adcb957f3291e320bea2762ef6d0c64feceeb.exe
      "C:\Users\Admin\AppData\Local\Temp\5d324a3f2d5ce77ea1d7744d8f6adcb957f3291e320bea2762ef6d0c64feceeb.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2532
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3420
  • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Users\Admin\AppData\Roaming\Blasthost.exe
      "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
      2⤵
      • Executes dropped EXE
      PID:2576
    • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:8
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5080
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4572
  • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Users\Admin\AppData\Roaming\Blasthost.exe
      "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
      2⤵
      • Executes dropped EXE
      PID:884
    • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3176
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:908
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1344
  • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Users\Admin\AppData\Roaming\Blasthost.exe
      "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
      2⤵
      • Executes dropped EXE
      PID:3000
    • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:964
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4672

Network

  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    71.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    75.117.19.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    75.117.19.2.in-addr.arpa
    IN PTR
    Response
    75.117.19.2.in-addr.arpa
    IN PTR
    a2-19-117-75deploystaticakamaitechnologiescom
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    73.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Blasthost.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
No results found
  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    71.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    71.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    75.117.19.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    75.117.19.2.in-addr.arpa

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    150 B
    268 B
    2
    2

    DNS Request

    Wealthy2019.com.strangled.net

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    128 B
    248 B
    2
    2

    DNS Request

    wealthyme.ddns.net

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    150 B
    268 B
    2
    2

    DNS Request

    Wealthy2019.com.strangled.net

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    73.209.201.84.in-addr.arpa
    dns
    144 B
    264 B
    2
    2

    DNS Request

    73.209.201.84.in-addr.arpa

    DNS Request

    73.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    144 B
    316 B
    2
    2

    DNS Request

    48.229.111.52.in-addr.arpa

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    128 B
    248 B
    2
    2

    DNS Request

    wealthyme.ddns.net

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    150 B
    268 B
    2
    2

    DNS Request

    Wealthy2019.com.strangled.net

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    128 B
    248 B
    2
    2

    DNS Request

    wealthyme.ddns.net

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    150 B
    268 B
    2
    2

    DNS Request

    Wealthy2019.com.strangled.net

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    128 B
    248 B
    2
    2

    DNS Request

    wealthyme.ddns.net

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    150 B
    268 B
    2
    2

    DNS Request

    Wealthy2019.com.strangled.net

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    128 B
    248 B
    2
    2

    DNS Request

    wealthyme.ddns.net

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    150 B
    268 B
    2
    2

    DNS Request

    Wealthy2019.com.strangled.net

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    128 B
    248 B
    2
    2

    DNS Request

    wealthyme.ddns.net

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Blasthost.exe
    150 B
    268 B
    2
    2

    DNS Request

    Wealthy2019.com.strangled.net

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Blasthost.exe
    128 B
    248 B
    2
    2

    DNS Request

    wealthyme.ddns.net

    DNS Request

    wealthyme.ddns.net

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Blasthost.exe

    Filesize

    132KB

    MD5

    6087bf6af59b9c531f2c9bb421d5e902

    SHA1

    8bc0f1596c986179b82585c703bacae6d2a00316

    SHA256

    3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c

    SHA512

    c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292

  • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

    Filesize

    1.4MB

    MD5

    38c20cfa6832b89ee67bad50b4f73c41

    SHA1

    6ccc97aa2d3884f94de5958fd675c44b6f0bf024

    SHA256

    69985f1c4eae27540b1458766e18ea9255e712505afaf8e7aefa5d5c5f4d7ee9

    SHA512

    ce0a856ca41b8fd3fc9621258732abe2a05f3a809dddc7acebe2fe7c56da520228a56bb9be2d67441c994855017330b814474f4856575c71bfe7059bbce8b13d

  • memory/884-79-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/908-76-0x00000000013D0000-0x00000000013D1000-memory.dmp

    Filesize

    4KB

  • memory/944-14-0x0000000001130000-0x0000000001131000-memory.dmp

    Filesize

    4KB

  • memory/944-25-0x00000000006E0000-0x000000000084B000-memory.dmp

    Filesize

    1.4MB

  • memory/944-0-0x00000000006E0000-0x000000000084B000-memory.dmp

    Filesize

    1.4MB

  • memory/1844-107-0x0000000000B80000-0x0000000000CEB000-memory.dmp

    Filesize

    1.4MB

  • memory/1920-28-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/1920-51-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/1956-74-0x0000000000B80000-0x0000000000CEB000-memory.dmp

    Filesize

    1.4MB

  • memory/2532-26-0x0000000000550000-0x0000000000551000-memory.dmp

    Filesize

    4KB

  • memory/2576-53-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2852-12-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/3456-30-0x0000000000B80000-0x0000000000CEB000-memory.dmp

    Filesize

    1.4MB

  • memory/3456-48-0x0000000000B80000-0x0000000000CEB000-memory.dmp

    Filesize

    1.4MB

  • memory/3936-23-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/3936-15-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/5028-98-0x00000000004D0000-0x00000000004ED000-memory.dmp

    Filesize

    116KB

  • memory/5080-49-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.