Overview

overview

10

Static

static

10

LegionStea...der.js

windows7-x64

3

LegionStea...der.js

windows10-2004-x64

3

LegionStea...ts.vbs

windows7-x64

1

LegionStea...ts.vbs

windows10-2004-x64

1

LegionStea...ts.vbs

windows7-x64

1

LegionStea...ts.vbs

windows10-2004-x64

1

LegionStea...m1.vbs

windows7-x64

1

LegionStea...m1.vbs

windows10-2004-x64

1

LegionStea...ral.js

windows7-x64

3

LegionStea...ral.js

windows10-2004-x64

3

LegionStea...al.vbs

windows7-x64

1

LegionStea...al.vbs

windows10-2004-x64

1

LegionStea...in.vbs

windows7-x64

1

LegionStea...in.vbs

windows10-2004-x64

1

LegionStea...der.js

windows7-x64

3

LegionStea...der.js

windows10-2004-x64

3

LegionStea...er.vbs

windows7-x64

1

LegionStea...er.vbs

windows10-2004-x64

1

LegionStea...es.vbs

windows7-x64

1

LegionStea...es.vbs

windows10-2004-x64

1

LegionStea...ver.js

windows7-x64

3

LegionStea...ver.js

windows10-2004-x64

3

LegionStea...er.vbs

windows7-x64

1

LegionStea...er.vbs

windows10-2004-x64

1

LegionStea...lby.js

windows7-x64

3

LegionStea...lby.js

windows10-2004-x64

3

LegionStea...by.vbs

windows7-x64

1

LegionStea...by.vbs

windows10-2004-x64

1

LegionStea...er.exe

windows7-x64

3

LegionStea...er.exe

windows10-2004-x64

3

LegionStea...er.exe

windows7-x64

3

LegionStea...er.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 18:34 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    LegionStealer V1 SRC/NewBuilder.js

  • Size

    4KB

  • MD5

    f630a91f5ad64da2d5fde049abec8809

  • SHA1

    607827cf9910b15d836b6b4e38a4cae41c05db99

  • SHA256

    31c1472a1a806d30b58c21cbb435d59ec9dd81eeb9f8f74829854758135eb34d

  • SHA512

    c106b5ce8517f753818c736d940d68483e3da22081babf8397b476b066a93c95ce7ca9130c804ed079b0e738ee2b25b87f6dc114e8e787cc69465c05a6b8b5cb

  • SSDEEP

    96:Jo4hU2nbXVghQ2jr6VbfoM9s7stb8TJ5y:9bph2jr6VToM9s7stb8TJ5y

Score
3/10
execution

Malware Config

Signatures

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\LegionStealer V1 SRC\NewBuilder.js"
    1⤵
      PID:4008

    Network

    • flag-us
      DNS
      73.209.201.84.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.209.201.84.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      69.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      69.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      88.156.103.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.156.103.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      slscr.update.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      slscr.update.microsoft.com
      IN A
      Response
      slscr.update.microsoft.com
      IN CNAME
      sls.update.microsoft.com
      sls.update.microsoft.com
      IN CNAME
      glb.sls.prod.dcat.dsp.trafficmanager.net
      glb.sls.prod.dcat.dsp.trafficmanager.net
      IN A
      20.12.23.50
    • flag-us
      DNS
      slscr.update.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      slscr.update.microsoft.com
      IN A
    • flag-us
      DNS
      53.210.109.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      53.210.109.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      53.210.109.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      53.210.109.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      98.117.19.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      98.117.19.2.in-addr.arpa
      IN PTR
      Response
      98.117.19.2.in-addr.arpa
      IN PTR
      a2-19-117-98deploystaticakamaitechnologiescom
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      14.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      101.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      101.210.23.2.in-addr.arpa
      IN PTR
      Response
      101.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-101deploystaticakamaitechnologiescom
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      ax-0001.ax-msedge.net
      ax-0001.ax-msedge.net
      IN A
      150.171.27.10
      ax-0001.ax-msedge.net
      IN A
      150.171.28.10
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239360453660_1FJYLRXUGJ1KYC379&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      150.171.27.10:443
      Request
      GET /th?id=OADD2.10239360453660_1FJYLRXUGJ1KYC379&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 405350
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: CE27478D5045417DB5EC0DBC9D797EC2 Ref B: LON601060108029 Ref C: 2024-11-04T18:38:07Z
      date: Mon, 04 Nov 2024 18:38:07 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239339388195_1RYLY5F6XPBD42AM3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.27.10:443
      Request
      GET /th?id=OADD2.10239339388195_1RYLY5F6XPBD42AM3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 577095
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 3B388A57D5A84CA48F8CB0409D2CB5F1 Ref B: LON601060108029 Ref C: 2024-11-04T18:38:07Z
      date: Mon, 04 Nov 2024 18:38:07 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239339388196_1AEUQN5G5GCJWJYJ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      150.171.27.10:443
      Request
      GET /th?id=OADD2.10239339388196_1AEUQN5G5GCJWJYJ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 582044
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: B7F9243304934D5EB6EF990D326162B2 Ref B: LON601060108029 Ref C: 2024-11-04T18:38:07Z
      date: Mon, 04 Nov 2024 18:38:07 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239360453482_1OGQPWVCF77KWCMMI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.27.10:443
      Request
      GET /th?id=OADD2.10239360453482_1OGQPWVCF77KWCMMI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 561868
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 73F8B57C997849A59FB059460627A037 Ref B: LON601060108029 Ref C: 2024-11-04T18:38:07Z
      date: Mon, 04 Nov 2024 18:38:07 GMT
    • 150.171.27.10:443
      https://tse1.mm.bing.net/th?id=OADD2.10239360453482_1OGQPWVCF77KWCMMI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      tls, http2
      76.0kB
       2.2MB
       1625
      1621

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239360453660_1FJYLRXUGJ1KYC379&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239339388195_1RYLY5F6XPBD42AM3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239339388196_1AEUQN5G5GCJWJYJ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239360453482_1OGQPWVCF77KWCMMI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls, http2
      1.1kB
       6.8kB
       13
      10
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls, http2
      1.1kB
       6.8kB
       13
      10
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       6.9kB
       16
      13
    • 8.8.8.8:53
      73.209.201.84.in-addr.arpa
      dns
      72 B
       132 B
       1
      1

      DNS Request

      73.209.201.84.in-addr.arpa

    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
       159 B
       1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      69.31.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      69.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      88.156.103.20.in-addr.arpa
      dns
      216 B
       318 B
       3
      2

      DNS Request

      88.156.103.20.in-addr.arpa

      DNS Request

      slscr.update.microsoft.com

      DNS Request

      slscr.update.microsoft.com

      DNS Response

      20.12.23.50

    • 8.8.8.8:53
      53.210.109.20.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      53.210.109.20.in-addr.arpa

      DNS Request

      53.210.109.20.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      98.117.19.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      98.117.19.2.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      26.35.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      26.35.223.20.in-addr.arpa

    • 8.8.8.8:53
      14.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      14.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      101.210.23.2.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      101.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      62 B
       170 B
       1
      1

      DNS Request

      tse1.mm.bing.net

      DNS Response

      150.171.27.10
      150.171.28.10

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.