Overview

overview

10

Static

static

3

8153087dbc...b3.exe

windows7-x64

7

8153087dbc...b3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 00:17 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe

  • Size

    78KB

  • MD5

    7bfbe9f42a7aa4e975f7946d44b3260f

  • SHA1

    35b0151f326b99687a8344c5af9e3fb431499ec9

  • SHA256

    8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3

  • SHA512

    7b8d5113fc2642541da57bef8cc7f53eaab22dc0f7c25c93f274ebf9ee17395912e494ebe86b3804547f5677a9bcf2d493a4fdee2f6dbd5501c628d848ea89f1

  • SSDEEP

    1536:9RWtHF3M7t/vZv0kH9gDDtWzYCnJPeoYrGQtRk9/O1GD:9RWtHF8h/l0Y9MDYrm7Rk9/H

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe
    "C:\Users\Admin\AppData\Local\Temp\8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lsov0-mo.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB5E8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB5E7.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2932
    • C:\Users\Admin\AppData\Local\Temp\tmpB57A.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpB57A.tmp.exe" C:\Users\Admin\AppData\Local\Temp\8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2820

Network

  • flag-us
    DNS
    bejnz.com
    tmpB57A.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    bejnz.com
    IN A
    Response
    bejnz.com
    IN A
    44.221.84.105
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:17:52 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=c6d375babc1ceb26b47637f81dbddba6|138.199.29.44|1728865072|1728865072|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:18:06 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=fe7a475241620ac3969890f080e76917|138.199.29.44|1728865086|1728865086|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:18:12 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=0139769106a106cd2eafe6b0047912b0|138.199.29.44|1728865092|1728865092|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:18:24 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=9563d1da7f28e669ccbb27dd6c0ec68f|138.199.29.44|1728865104|1728865104|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:18:29 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=50949acbc20cf406538fd4489945544b|138.199.29.44|1728865109|1728865109|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:18:31 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=2e99da7e0e29a245475364d3febf0345|138.199.29.44|1728865111|1728865111|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:19:47 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=962c5432ba769b14502c9445d3a30f87|138.199.29.44|1728865187|1728865187|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:19:49 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=fc53ca96b9d106cac7982e60860dd315|138.199.29.44|1728865189|1728865189|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:19:51 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=a7ab3209a4ee2742060da572ddd583dd|138.199.29.44|1728865191|1728865191|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:19:53 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=d34337b44c087b3ebdee6ebc7e3b52b5|138.199.29.44|1728865193|1728865193|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:19:56 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=704815e3ee4bddbca411ba1443974565|138.199.29.44|1728865196|1728865196|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:19:58 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=4839e2d0231972d7c137e23037d22b05|138.199.29.44|1728865198|1728865198|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:20:01 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=17bfd2e9a7e5b2eb3ea661032086b9c8|138.199.29.44|1728865201|1728865201|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:20:03 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=2b08dff94d39bb7ce203e52d1ccc4af2|138.199.29.44|1728865203|1728865203|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:20:05 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=84c0c248f6e401e329e067bac4d81aa1|138.199.29.44|1728865205|1728865205|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:20:08 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=04efd2c68181fb3569558e4d82d25274|138.199.29.44|1728865208|1728865208|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:20:10 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=10052a53574463bed3fe90dc91aa4eed|138.199.29.44|1728865210|1728865210|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://bejnz.com/IP.php
    tmpB57A.tmp.exe
    Remote address:
    44.221.84.105:80
    Request
    GET /IP.php HTTP/1.1
    Host: bejnz.com
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Mon, 14 Oct 2024 00:20:12 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=124d48782f8a98c64ac233b1776adb42|138.199.29.44|1728865212|1728865212|0|1|0; path=/; domain=.bejnz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=138.199.29.44; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    295 B
     623 B
     5
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    504 B
     667 B
     9
    6

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    369 B
     583 B
     7
    4

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    417 B
     619 B
     8
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    369 B
     615 B
     7
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    409 B
     615 B
     8
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    955 B
     216 B
     15
    5

    HTTP Request

    GET http://bejnz.com/IP.php
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    369 B
     623 B
     7
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    271 B
     623 B
     5
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    317 B
     623 B
     6
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    271 B
     615 B
     5
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    271 B
     623 B
     5
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    352 B
     615 B
     6
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    271 B
     615 B
     5
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    271 B
     623 B
     5
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    271 B
     623 B
     5
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    271 B
     623 B
     5
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    317 B
     623 B
     6
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    http://bejnz.com/IP.php
    http
    tmpB57A.tmp.exe
    317 B
     615 B
     6
    5

    HTTP Request

    GET http://bejnz.com/IP.php

    HTTP Response

    200
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 44.221.84.105:80
    bejnz.com
    tmpB57A.tmp.exe
    52 B
     1
  • 127.0.0.1:127
    tmpB57A.tmp.exe
  • 8.8.8.8:53
    bejnz.com
    dns
    tmpB57A.tmp.exe
    55 B
     71 B
     1
    1

    DNS Request

    bejnz.com

    DNS Response

    44.221.84.105

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RESB5E8.tmp
    Filesize

    1KB

    MD5

    40f485bd74e4fdfa2b3eb08a334a6988

    SHA1

    862f215c27a144e0297c1cda88050252dff1c284

    SHA256

    cc47dddeba31c692b3525ba31be7a2c6e9ea7bc65335df65bbf54d6a989152ea

    SHA512

    fe62fb2904263e34fac50d849e5119bcfe9c008a1847b430f9786a4f3b096f86e494d4aa62e9a5bcd47f983a5e10b64fe6e7704a8e74ec4344637269a38620ef

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\lsov0-mo.0.vb
    Filesize

    15KB

    MD5

    194039781f2fa9bba5e5c334f68eab22

    SHA1

    f058c1bdd8927d293bb3453a133dd830800bf227

    SHA256

    92f2432d6fadc232b002a3666475dc7c40973a02eeb26f13be3cfc3e2ffa044a

    SHA512

    c8a7275c0358497eede44cbdf2b2755c6ce2088e7309b1f68445d33fe4390a395f5f50bfcbc93225bf3ebd2b87f692b72205681ecc13453c7e870f7e5d561b84

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\lsov0-mo.cmdline
    Filesize

    266B

    MD5

    cd1958dfa752c5987f4525c677d51a5a

    SHA1

    9cb3c9b5a1e507f481e7b26b1b270f5c3ad6bc77

    SHA256

    7b38772c1e33ae3476240a61a41391ba9ce504329a5b4b5947dead9e00c30a78

    SHA512

    eda2bf6ca853b29b575067b24d0af33e419552ab3f8f7c5f66133725f25655a291718c2cb17979d5baa3ede5009728e8894dd7a00e09a6b7b324cbf7ccabbb07

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpB57A.tmp.exe
    Filesize

    78KB

    MD5

    91c4685b31172962bf6b5ee1d99f5794

    SHA1

    fc85e74f6a0cc172191e397884416f54167082ab

    SHA256

    b56e89e266a2b5b5ee977d5c2062bb303bd7eec6d6b3371f77c966c504b14d15

    SHA512

    21ae56d0bd682fe7746be665a2443d16914a81707696f1af662d08decb591f32a8e9035115d4bfad06808b97c9009a503e9ca86d7e1ff7fd3ef2b98af9194519

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbcB5E7.tmp
    Filesize

    660B

    MD5

    6d1275ee7b413b79a922ce629867a519

    SHA1

    920a66a5632f4d5a5037e458bfcfba052c0860a5

    SHA256

    c5191eeafdaf787a15fd185567a3f298accb197c5a1d0f51cd6d3bb42d75cb21

    SHA512

    62df7a513a5a328a18649e4b31e7b58df3cc51265ea4c15a4ccb02fcd854312416daba1099ec7c9b62b105be2452c2623dc5eb546ea19d09db166ec814f446e8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources
    Filesize

    62KB

    MD5

    8b25b4d931908b4c77ce6c3d5b9a2910

    SHA1

    88b65fd9733484c8f8147dad9d0896918c7e37c7

    SHA256

    79c261ab6b394ee23ab0fd0af48bcd96f914c6bb88b36b6815b6bbf787ecd56e

    SHA512

    6d954066cec5eca118601f2f848f5c9deebe3761ac285c6d45041df22e4bc4e9e2fd98c1aa4fbb6b9c735151bf8d5fffa5acddf7060a4cf3cb7e09271a4a926d

    Download Submit

  • memory/2160-18-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2160-8-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2780-0-0x0000000074491000-0x0000000074492000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2780-1-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2780-24-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2780-3-0x0000000074490000-0x0000000074A3B000-memory.dmp

    Filesize

    5.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.