Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-01-2025 18:52

General

  • Target

    ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358.exe

  • Size

    1.2MB

  • MD5

    69317804c5579e73340861d31cdb32d6

  • SHA1

    e659d2048db8cb18a3c8c1ae856ab26dae72001c

  • SHA256

    ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358

  • SHA512

    9f9ea28f167255c60712f93961eab6b2b550bc43de884040eb7d20c5815193379e9e162b1941768092a697a29047353182075f9975848f355db68ce40f4ba449

  • SSDEEP

    24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiZ:WIwgMEuy+inDfp3/XoCw57XYBwKZ

Malware Config

Signatures

  • Detect PurpleFox Rootkit 7 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 8 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Gh0strat family
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Purplefox family
  • Drops file in Drivers directory 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 3 IoCs
  • VMProtect packed file 10 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 7 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358.exe
    "C:\Users\Admin\AppData\Local\Temp\ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\AK47.exe
      "C:\Users\Admin\AppData\Local\Temp\AK47.exe"
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:3504
    • C:\Users\Admin\AppData\Local\Temp\AK47.exe
      C:\Users\Admin\AppData\Local\Temp\\AK47.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:2036
    • C:\Users\Admin\AppData\Local\Temp\AK74.exe
      C:\Users\Admin\AppData\Local\Temp\\AK74.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\AK74.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4344
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4420
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2720
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
    1⤵
      PID:4788
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
        C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240619531.txt",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3304
    • C:\Windows\SysWOW64\Ghiya.exe
      C:\Windows\SysWOW64\Ghiya.exe -auto
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Windows\SysWOW64\Ghiya.exe
        C:\Windows\SysWOW64\Ghiya.exe -acsi
        2⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Executes dropped EXE
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:5052

    Network

    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      73.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      167.173.78.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      167.173.78.104.in-addr.arpa
      IN PTR
      Response
      167.173.78.104.in-addr.arpa
      IN PTR
      a104-78-173-167deploystaticakamaitechnologiescom
    • flag-us
      DNS
      104.219.191.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      104.219.191.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      133.211.185.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.211.185.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      56.163.245.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.163.245.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      180.129.81.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      180.129.81.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      8.153.16.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.153.16.2.in-addr.arpa
      IN PTR
      Response
      8.153.16.2.in-addr.arpa
      IN PTR
      a2-16-153-8deploystaticakamaitechnologiescom
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • 43.249.193.73:54997
      ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358.exe
      260 B
      5
    • 43.249.193.73:54997
      ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358.exe
      260 B
      5
    • 43.249.193.73:54997
      ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358.exe
      260 B
      5
    • 43.249.193.73:54997
      ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358.exe
      260 B
      5
    • 43.249.193.73:54997
      ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358.exe
      260 B
      5
    • 43.249.193.73:54997
      ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358.exe
      260 B
      5
    • 43.249.193.73:54997
      ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358.exe
      260 B
      5
    • 43.249.193.73:54997
      ecd5b1a386fec96d56a81d9e037d2d563dae3f7968750ee95bde7842e22b6358.exe
    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
      159 B
      1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      73.31.126.40.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      73.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      167.173.78.104.in-addr.arpa
      dns
      73 B
      139 B
      1
      1

      DNS Request

      167.173.78.104.in-addr.arpa

    • 8.8.8.8:53
      104.219.191.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      104.219.191.52.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      133.211.185.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      133.211.185.52.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      56.163.245.4.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      56.163.245.4.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      180.129.81.91.in-addr.arpa
      dns
      72 B
      147 B
      1
      1

      DNS Request

      180.129.81.91.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      8.153.16.2.in-addr.arpa
      dns
      69 B
      131 B
      1
      1

      DNS Request

      8.153.16.2.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      136 B
      258 B
      2
      2

      DNS Request

      cf1549064127.f3322.net

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      136 B
      258 B
      2
      2

      DNS Request

      cf1549064127.f3322.net

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      136 B
      258 B
      2
      2

      DNS Request

      cf1549064127.f3322.net

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      136 B
      258 B
      2
      2

      DNS Request

      cf1549064127.f3322.net

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      136 B
      258 B
      2
      2

      DNS Request

      cf1549064127.f3322.net

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
    • 8.8.8.8:53

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\AK47.exe

      Filesize

      91KB

      MD5

      423eb994ed553294f8a6813619b8da87

      SHA1

      eca6a16ccd13adcfc27bc1041ddef97ec8081255

      SHA256

      050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218

      SHA512

      fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095

    • C:\Users\Admin\AppData\Local\Temp\AK74.exe

      Filesize

      400KB

      MD5

      b0998aa7d5071d33daa5b60b9c3c9735

      SHA1

      9365a1ff0c6de244d6f36c8d84072cc916665d3c

      SHA256

      3080b6bb456564899b0d99d4131bd6a0b284d31f7d80ef773e4872d94048d49a

      SHA512

      308c13cda9fea39b980ae686f44afd9090e9cb8970fffc4436320e0d09a31aee5e656914e0121fe888098a14c52749716fa04980396fd6ac70a88c11cbb6b850

    • C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

      Filesize

      92B

      MD5

      29ce53e2a4a446614ccc8d64d346bde4

      SHA1

      39a7aa5cc1124842aa0c25abb16ea94452125cbe

      SHA256

      56225be6838bc6e93ea215891eacf28844ae27a9f8b2b29bf19d3a8c2b1f58df

      SHA512

      b2c5a2708c427171a5715801f8ea733ffe88d73aaaaf59c5c752ea32cbe7aae8526cc26eabe84ad5043174c0c69b1d6b15a9fb125c15accfac3462d5d08a0faa

    • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

      Filesize

      753B

      MD5

      28036d209a5db3e5a16a3cd7c2feae7d

      SHA1

      1bd11a27104b0fdbda27a0faf6cba224ec483520

      SHA256

      81a1c0152816fe592c388df7545f444ad2567f2ff77b7a9278df6da92b131acb

      SHA512

      3f2647ee4ba199dd86f8733ae8dbdf714937c481bf82d90c1d9ef8cf980030abf761d7458152faedc41e666eded7c75fc32f69bdc392043921dc06dfaf456239

    • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

      Filesize

      1.2MB

      MD5

      ab4dff52911b77a4dcc21959666c0515

      SHA1

      3f68425b6d2741d933a20e32529c4adc49e9edcb

      SHA256

      b2a8502598cc0cf924cc107669d4c0fb8d1f9b2e557042fde15e656aa2c9f5c8

      SHA512

      8b250780b1a66205e11d381aada953b6ce02d2d929e4f0c599ccc21e42e79686e8b831ba02b6dcc8a52d8e87f58b4dee705590db89ef05896c4e3f6403c5bda4

    • C:\Windows\SysWOW64\240619531.txt

      Filesize

      49KB

      MD5

      335b8daaaae5752b2b6413bb74298c28

      SHA1

      018698b6ee7cd10c77966c27a151822722de1711

      SHA256

      f4c4a1d5513a4aa2bf5323faad06862b7ae6276cf19ef0c9c0a79f9e8727cff2

      SHA512

      c38a9431342010e5f23f93cc98a3b4c7ee1af35ae609d33d435f7035d43c0f35160b66986813c403ce051c46f640803b925a09584613153103980f1d4281d4ed

    • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

      Filesize

      60KB

      MD5

      889b99c52a60dd49227c5e485a016679

      SHA1

      8fa889e456aa646a4d0a4349977430ce5fa5e2d7

      SHA256

      6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

      SHA512

      08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

    • memory/548-82-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/548-85-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/548-0-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/548-79-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/548-75-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/548-72-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/548-69-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/548-88-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/548-1-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/2436-30-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/2436-31-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/2436-29-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/2452-37-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/2452-40-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/2452-39-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/5052-55-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/5052-53-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/5052-49-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.