Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 04:09
Static task
static1
Behavioral task
behavioral1
Sample
2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe
Resource
win10v2004-20241007-en
General
-
Target
2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe
-
Size
603KB
-
MD5
4d74cebd8ddaae78de8144f1abb245e5
-
SHA1
8e8423e4af53a91b9750014235773f9ec38916df
-
SHA256
2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9
-
SHA512
db4959b2a762416a62fc95fd06c5b5836189ef6e785cfaaaa2e26e28602a8db2aa71893dd72833490cdf631321ac6c7ab5a168bbf671dfa1bb98ab8c827d3426
-
SSDEEP
12288:fYVqW8F9057V2WnuYJBcw/6oxYP4Tl9SZZGQ4qS6q:rLs0WnuYP6KeokZZGdqbq
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot8071929169:AAFUKNAcxQ6ezyCHGQASc7PxQv_smeADnUQ/sendMessage?chat_id=5985897351
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
resource yara_rule behavioral1/memory/2300-30-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2300-29-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2300-25-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2300-23-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2300-28-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Snakekeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2768 powershell.exe 2856 powershell.exe -
Deletes itself 1 IoCs
pid Process 1724 cmd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2060 set thread context of 2300 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2900 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2300 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 2768 powershell.exe 2856 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2300 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe Token: SeDebugPrivilege 2768 powershell.exe Token: SeDebugPrivilege 2856 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2768 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 29 PID 2060 wrote to memory of 2768 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 29 PID 2060 wrote to memory of 2768 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 29 PID 2060 wrote to memory of 2768 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 29 PID 2060 wrote to memory of 2856 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 31 PID 2060 wrote to memory of 2856 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 31 PID 2060 wrote to memory of 2856 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 31 PID 2060 wrote to memory of 2856 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 31 PID 2060 wrote to memory of 2900 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 33 PID 2060 wrote to memory of 2900 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 33 PID 2060 wrote to memory of 2900 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 33 PID 2060 wrote to memory of 2900 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 33 PID 2060 wrote to memory of 2300 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 35 PID 2060 wrote to memory of 2300 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 35 PID 2060 wrote to memory of 2300 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 35 PID 2060 wrote to memory of 2300 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 35 PID 2060 wrote to memory of 2300 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 35 PID 2060 wrote to memory of 2300 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 35 PID 2060 wrote to memory of 2300 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 35 PID 2060 wrote to memory of 2300 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 35 PID 2060 wrote to memory of 2300 2060 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 35 PID 2300 wrote to memory of 1724 2300 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 36 PID 2300 wrote to memory of 1724 2300 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 36 PID 2300 wrote to memory of 1724 2300 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 36 PID 2300 wrote to memory of 1724 2300 2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe 36 PID 1724 wrote to memory of 1244 1724 cmd.exe 38 PID 1724 wrote to memory of 1244 1724 cmd.exe 38 PID 1724 wrote to memory of 1244 1724 cmd.exe 38 PID 1724 wrote to memory of 1244 1724 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe"C:\Users\Admin\AppData\Local\Temp\2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WYqxTmjfOgdZ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WYqxTmjfOgdZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1989.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2900
-
-
C:\Users\Admin\AppData\Local\Temp\2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe"C:\Users\Admin\AppData\Local\Temp\2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
- System Location Discovery: System Language Discovery
PID:1244
-
-
-
Network
-
Remote address:8.8.8.8:53Requestcheckip.dyndns.orgIN AResponsecheckip.dyndns.orgIN CNAMEcheckip.dyndns.comcheckip.dyndns.comIN A132.226.247.73checkip.dyndns.comIN A193.122.6.168checkip.dyndns.comIN A132.226.8.169checkip.dyndns.comIN A193.122.130.0checkip.dyndns.comIN A158.101.44.242
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: b80c913d64f1d37ee4a965de486a3081
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 57b6905ca471f3bd239900783102cf7b
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 504 Gateway Time-out
Content-Type: text/html
Content-Length: 557
Connection: keep-alive
X-Request-ID: 1bc21a825fe2eb478f57d1d5cf441745
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 852a84611df37d2d83507d1bffe4d99f
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 0df86cbb162a6a9024c8a049f3ab127d
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 81210ba6f181eef0144501920f2f8efd
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: f92786abdd4809fbdd3f36f0d9445acf
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 6378cdf65675b3ea4fc4afa8ffd51f1a
-
Remote address:132.226.247.73:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 244a7b61bac14ab75cce1c80d18639af
-
Remote address:8.8.8.8:53Requestreallyfreegeoip.orgIN AResponsereallyfreegeoip.orgIN A104.21.67.152reallyfreegeoip.orgIN A172.67.177.134
-
GEThttps://reallyfreegeoip.org/xml/181.215.176.832a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exeRemote address:104.21.67.152:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 476873
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z9Q0K9qS%2FV7UkuZTZisMWlD2aD%2BA8qCDsz%2FU9tgobK5ItCcHBPCCKC2d3oO5%2BA%2BLdvPsu0a3R62B3QDX9ddNZ9pNyuqMx7VQuCpjdr3BHvgvURDdYrdm0XhIfTexFwDLZ0Mhcbe7"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8e4d598e29f9719f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=57512&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2866&recv_bytes=374&delivery_rate=65738&cwnd=251&unsent_bytes=0&cid=51ec5fa513fcbf7b&ts=239&x=0"
-
GEThttps://reallyfreegeoip.org/xml/181.215.176.832a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exeRemote address:104.21.67.152:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 476882
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gnzknMc13oiDCs4tEQBlm0mkY5nQaVncLWR7f7JX%2BqNawRrF2cKhNPHuyqqHQZYntDCj7VC3H%2BnNnIii8J%2FnjMynn4VSCrZfaZy6pg3c00twYwGEBiMQ6jq9kkVCwEkRDRj1hMq5"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8e4d59c50831719f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=80878&sent=6&recv=8&lost=0&retrans=0&sent_bytes=4119&recv_bytes=475&delivery_rate=65738&cwnd=252&unsent_bytes=0&cid=51ec5fa513fcbf7b&ts=9016&x=0"
-
GEThttps://reallyfreegeoip.org/xml/181.215.176.832a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exeRemote address:104.21.67.152:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 476884
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=savtEy20wYCZwZjZJ4NKIUNnCkAPoiuMoN8PiaoqfdqOc8lYs7MW8aOOVExNXbasBvNNYqkvtriOo2b4D7joTa6MWrk80FKEnPYJBwyM2Fc4XIORM9liQ%2BJ7sb6%2BQZzp8%2BMHcmdr"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8e4d59d72eec719f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=102283&sent=7&recv=10&lost=0&retrans=0&sent_bytes=5372&recv_bytes=576&delivery_rate=65738&cwnd=253&unsent_bytes=0&cid=51ec5fa513fcbf7b&ts=11918&x=0"
-
GEThttps://reallyfreegeoip.org/xml/181.215.176.832a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exeRemote address:104.21.67.152:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 476887
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EFh1TqRuvyYJPpdyqhY5rkPullXJEI93Qx%2FpFXzzyYqSc9Zdh8jgqySpvVc%2F1123TSxdfWIHcMnSfF%2B34l3%2BZanehCkEeiH7cFzEgvmwePBP6lREQjS8pSFUIDHl1KGMi1HcBAdn"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8e4d59e94e7d719f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=120638&sent=8&recv=12&lost=0&retrans=0&sent_bytes=6625&recv_bytes=677&delivery_rate=65738&cwnd=254&unsent_bytes=0&cid=51ec5fa513fcbf7b&ts=14816&x=0"
-
GEThttps://reallyfreegeoip.org/xml/181.215.176.832a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exeRemote address:104.21.67.152:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 476891
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pJ2DmUk1xIKlJdKCTR4nP%2FaDWHNJNDC8phnIYGkiXFQ6St6kaU4H9m0TxcZmRh5LmtO%2BH52fSFCZdo4NVvCwKBhMLWF3g7CMyy9SW3sHPO5GM9zmOdej6bBwirqdxFMjSYefoHJh"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8e4d5a01a82d719f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=137247&sent=9&recv=14&lost=0&retrans=0&sent_bytes=7878&recv_bytes=778&delivery_rate=65738&cwnd=255&unsent_bytes=0&cid=51ec5fa513fcbf7b&ts=18719&x=0"
-
GEThttps://reallyfreegeoip.org/xml/181.215.176.832a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exeRemote address:104.21.67.152:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 476894
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cdMUSRzNOW6uRxreVKLIRJZfAhIncOl9XAud5pabZpORuU8nnqoHPP1TegCoSN79%2FhKLXBnobZiZjVUIQF%2FTi%2BRgmv%2BIFzv0srSM2i2E%2BS9HuiqHue60SsE6PbKogdf5JjU3fMff"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8e4d5a13cfb6719f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=149418&sent=10&recv=16&lost=0&retrans=0&sent_bytes=9131&recv_bytes=879&delivery_rate=65738&cwnd=255&unsent_bytes=0&cid=51ec5fa513fcbf7b&ts=21617&x=0"
-
GEThttps://reallyfreegeoip.org/xml/181.215.176.832a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exeRemote address:104.21.67.152:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 476897
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v%2F52UHp%2Bz7bHFdMK%2F9V8n8vaniafQnnELxeNDHUvCwRoSF1a4eSYiIXPl%2B3VviSajvy1KHx1VKGpYdZZugKAlXStdr%2FjvH6wNN5tHX0gAWBxY7MSybVleUccWdsS8q%2FeOik6J4Rk"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8e4d5a266efe719f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=160512&sent=11&recv=18&lost=0&retrans=0&sent_bytes=10384&recv_bytes=980&delivery_rate=65738&cwnd=255&unsent_bytes=0&cid=51ec5fa513fcbf7b&ts=24595&x=0"
-
132.226.247.73:80http://checkip.dyndns.org/http2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe2.0kB 4.0kB 20 17
HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
504HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200 -
104.21.67.152:443https://reallyfreegeoip.org/xml/181.215.176.83tls, http2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe1.8kB 12.2kB 19 13
HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200
-
8.8.8.8:53checkip.dyndns.orgdns2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe64 B 176 B 1 1
DNS Request
checkip.dyndns.org
DNS Response
132.226.247.73193.122.6.168132.226.8.169193.122.130.0158.101.44.242
-
8.8.8.8:53reallyfreegeoip.orgdns2a2625e85758dfdc4ab64036bb679f519b8802ecccdba37eec44fb99e68e35a9.exe65 B 97 B 1 1
DNS Request
reallyfreegeoip.org
DNS Response
104.21.67.152172.67.177.134
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ea90c7aa9433028fbe4ae745ad937160
SHA1918c07915e77d59d2f31e5daba635c4814c86f53
SHA256f6db615b5097ebfea08f847200643e1219295256106cb0b1cb4f5154172dc060
SHA512f3df80aedd8a9a9c128c41798355b92969b9626fa6c39d4ab97ff8a3cef0b7e466620365ce3f33176a91f36d586e95245abecf21dcc6234795d91b382586411d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD57b9dd6c5d8612e0e577e3511f58298bc
SHA14da8a18ae275dbfb975469fcfdb5510d7ba3f171
SHA256fefb4e0232b9c62c551afbe11adcb55755b6f468dadf3a58ad7296325012944d
SHA5129036949e8a7db8cd7576caf89b3edfe770993b4092a2938d852166a194edc8cbaad1368deb43cd59305915e2ef42e502f5a92311a14e624ccee4f8682b4d0bac