Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11/11/2024, 06:29 UTC
General
-
Target
7zS850A099E/61e74fd53f766_Tue23ec97445e.exe
-
Size
160KB
-
MD5
8f70a0f45532261cb4df2800b141551d
-
SHA1
521bbc045dfb7bf9fca55058ed2fc03d86cf8d00
-
SHA256
aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5
-
SHA512
3ea19ee472f3c7f9b7452fb4769fc3cc7591acff0f155889d08dadbd1f6ae289eaa310e220279318ac1536f99ea88e43ff75836aee47f3b4fbe8aa477cb9d099
-
SSDEEP
3072:ApO0Xavhlw60rsxWJ8D3yfiqIATrEFvEERHX6hS/6ZuPQXSon+k79eX4Yo:0/o8rsxWawiqDAxHX2SyZuPQXzqIN
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e74fd53f766_Tue23ec97445e.exe"C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e74fd53f766_Tue23ec97445e.exe"1⤵
- System Location Discovery: System Language Discovery
Network
-
DNSpastebin.comRemote address:8.8.8.8:53Requestpastebin.comIN AResponsepastebin.comIN A104.20.4.235pastebin.comIN A172.67.19.24pastebin.comIN A104.20.3.235 -
GEThttps://pastebin.com/raw/A7dSG1te%EF%BF%AB%EF%BF%A4Remote address:104.20.4.235:443RequestGET /raw/A7dSG1te%EF%BF%AB%EF%BF%A4 HTTP/1.1
Connection: Keep-Alive
User-Agent:
Host: pastebin.com
ResponseHTTP/1.1 404 Not Found
Date: Mon, 11 Nov 2024 06:30:30 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1;mode=block
set-cookie: _csrf-frontend=9e2dd81f4af692cbe2e2cd56dd6e8d64303971523766922b4a2c94e2c5dc0e66a%3A2%3A%7Bi%3A0%3Bs%3A14%3A%22_csrf-frontend%22%3Bi%3A1%3Bs%3A32%3A%22UsWgTMQD59J4jtUwYxHM3cOudghHgnO1%22%3B%7D; path=/; HttpOnly
CF-Cache-Status: BYPASS
Server: cloudflare
CF-RAY: 8e0c3be77e2960e7-LHR
-
DNSwfsdragon.ruRemote address:8.8.8.8:53Requestwfsdragon.ruIN AResponsewfsdragon.ruIN A104.21.5.208wfsdragon.ruIN A172.67.133.215
-
GEThttp://wfsdragon.ru/api/setStats.phpRemote address:104.21.5.208:80RequestGET /api/setStats.php HTTP/1.1
Connection: Keep-Alive
User-Agent: ???Kll
Host: wfsdragon.ru
ResponseHTTP/1.1 404 Not Found
Date: Mon, 11 Nov 2024 06:30:30 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E%2F1k3L4eCnY899OVI1DzlYj2Wj9uGr7NhzqQb5rGwfi7QX68wtynf7MUvQYv7MkLEGbwpz7ZCakwvsZ3%2FR%2BopAByapyvePrkysY5XlMBFVpIUz2SCMJuXJDYClIasO8%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8e0c3be8eab34177-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=24391&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=98&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
-
212.193.30.45:80 -
45.144.225.57:80
-
104.20.4.235:443https://pastebin.com/raw/A7dSG1te%EF%BF%AB%EF%BF%A4tls, http
HTTP Request
GET https://pastebin.com/raw/A7dSG1te%EF%BF%AB%EF%BF%A4HTTP Response
404 -
104.21.5.208:80http://wfsdragon.ru/api/setStats.phphttp
HTTP Request
GET http://wfsdragon.ru/api/setStats.phpHTTP Response
404 -
2.56.59.42:80
-
8.8.8.8:53pastebin.comdns
DNS Request
pastebin.com
DNS Response
104.20.4.235172.67.19.24104.20.3.235
-
8.8.8.8:53wfsdragon.rudns
DNS Request
wfsdragon.ru
DNS Response
104.21.5.208172.67.133.215