Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

dd336f129c...7N.exe

windows7-x64

10

dd336f129c...7N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 00:52 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dd336f129c10427622e8cf2c30c2d420d2b5d58e489f29f460d17e8176f8ad37N.exe

  • Size

    90KB

  • MD5

    79bf9a0a58c4f409717afe729cfde310

  • SHA1

    bb3ab7a59ca5e3f2e1582e13b21f2df11afaface

  • SHA256

    dd336f129c10427622e8cf2c30c2d420d2b5d58e489f29f460d17e8176f8ad37

  • SHA512

    df0009538be75b862108a0e12e407bbdc5165702c01bf37802c0fe7e724c8d75ace8fadfe1677d611a27b9f6edf7f3c3cc9cca0b2cff68bbd5a1a41f9a0d9649

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd336f129c10427622e8cf2c30c2d420d2b5d58e489f29f460d17e8176f8ad37N.exe
    "C:\Users\Admin\AppData\Local\Temp\dd336f129c10427622e8cf2c30c2d420d2b5d58e489f29f460d17e8176f8ad37N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Users\Admin\AppData\Local\Temp\dd336f129c10427622e8cf2c30c2d420d2b5d58e489f29f460d17e8176f8ad37N.exe
      "C:\Users\Admin\AppData\Local\Temp\dd336f129c10427622e8cf2c30c2d420d2b5d58e489f29f460d17e8176f8ad37N.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4980
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BHMCO.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:4336
      • C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:544
        • C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2584

Network

  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.205.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.205.248.87.in-addr.arpa
    IN PTR
    Response
    0.205.248.87.in-addr.arpa
    IN PTR
    https-87-248-205-0lgwllnwnet
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    98.117.19.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    98.117.19.2.in-addr.arpa
    IN PTR
    Response
    98.117.19.2.in-addr.arpa
    IN PTR
    a2-19-117-98deploystaticakamaitechnologiescom
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239398629831_1XETNM7TBCG6PTKQG&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239398629831_1XETNM7TBCG6PTKQG&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 944920
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: B0008F9D4F9044AEA2DB4EB974F9A30B Ref B: LON601060105025 Ref C: 2024-10-18T00:53:54Z
    date: Fri, 18 Oct 2024 00:53:54 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239398629832_1AECK4YD8K87JKVB5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239398629832_1AECK4YD8K87JKVB5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 644823
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E335322421F145C0A15EFAB4DCC99E04 Ref B: LON601060105025 Ref C: 2024-10-18T00:53:54Z
    date: Fri, 18 Oct 2024 00:53:54 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418577_1YCPJO6YBYEE06VWA&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418577_1YCPJO6YBYEE06VWA&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 488443
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: FCC048751E1E42A082DED8BB4BE8DBAC Ref B: LON601060105025 Ref C: 2024-10-18T00:53:54Z
    date: Fri, 18 Oct 2024 00:53:54 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418578_1AMTWIX1RFG5EZ1V6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418578_1AMTWIX1RFG5EZ1V6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 1061732
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 2857C6B53F5E419293F5CED6735BD517 Ref B: LON601060105025 Ref C: 2024-10-18T00:53:54Z
    date: Fri, 18 Oct 2024 00:53:54 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301113_1JN5SDQBM09J1FJBH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301113_1JN5SDQBM09J1FJBH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 753716
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 6B18E47AD1084D8991269D2A11358725 Ref B: LON601060105025 Ref C: 2024-10-18T00:53:54Z
    date: Fri, 18 Oct 2024 00:53:54 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301546_1Q2R62QH97KH2KYXT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301546_1Q2R62QH97KH2KYXT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 575788
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F8B4A03483B1482A8CA0A377AD4775EC Ref B: LON601060105025 Ref C: 2024-10-18T00:53:55Z
    date: Fri, 18 Oct 2024 00:53:54 GMT
  • flag-us
    DNS
    10.27.171.150.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.27.171.150.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    200.201.50.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.201.50.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.201.50.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.201.50.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • flag-us
    DNS
    billabong4102.no-ip.biz
    csrsll.exe
    Remote address:
    8.8.8.8:53
    Request
    billabong4102.no-ip.biz
    IN A
    Response
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301546_1Q2R62QH97KH2KYXT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    159.8kB
     4.6MB
     3367
    3364

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239398629831_1XETNM7TBCG6PTKQG&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239398629832_1AECK4YD8K87JKVB5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418577_1YCPJO6YBYEE06VWA&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418578_1AMTWIX1RFG5EZ1V6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301113_1JN5SDQBM09J1FJBH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301546_1Q2R62QH97KH2KYXT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     7.0kB
     16
    14
  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    0.205.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    0.205.248.87.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    98.117.19.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    98.117.19.2.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    13.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     170 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    10.27.171.150.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    10.27.171.150.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    69 B
     129 B
     1
    1

    DNS Request

    billabong4102.no-ip.biz

  • 8.8.8.8:53
    200.201.50.20.in-addr.arpa
    dns
    144 B
     316 B
     2
    2

    DNS Request

    200.201.50.20.in-addr.arpa

    DNS Request

    200.201.50.20.in-addr.arpa

  • 8.8.8.8:53
    billabong4102.no-ip.biz
    dns
    csrsll.exe
    138 B
     258 B
     2
    2

    DNS Request

    billabong4102.no-ip.biz

    DNS Request

    billabong4102.no-ip.biz

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\BHMCO.txt
    Filesize

    145B

    MD5

    4eb61ec7816c34ec8c125acadc57ec1b

    SHA1

    b0015cc865c0bb1a027be663027d3829401a31cc

    SHA256

    08375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff

    SHA512

    f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
    Filesize

    90KB

    MD5

    1be96e2449cb848f90e24b3ddd4c3d24

    SHA1

    269c7969d5aab46e7ab6e96be215914e2eb9337d

    SHA256

    a9a4ab2e0d60411eaee9019cd054b8e6f52464605473031ee5c815c024b1d765

    SHA512

    4ef779454c616607c6a3f20620599bc9fd1bdbbc81ee371b54b3b8d32b463e2b96ef33ec2477c59917c9505ba0cd763eab8a9831ba25b2ca8a2de16be4700a89

    Download Submit

  • memory/544-61-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1772-58-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

    Download

  • memory/1772-36-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

    Download

  • memory/1772-42-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

    Download

  • memory/1772-41-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

    Download

  • memory/2008-11-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

    Download

  • memory/2008-4-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

    Download

  • memory/2008-5-0x0000000002330000-0x0000000002332000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2008-3-0x0000000002310000-0x0000000002312000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2008-6-0x0000000002340000-0x0000000002342000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2008-0-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

    Download

  • memory/2584-55-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2584-62-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2584-46-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2584-52-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2584-53-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2584-56-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download

  • memory/4980-9-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/4980-40-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/4980-60-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/4980-13-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/4980-7-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.