Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-01-2025 09:24
Behavioral task
behavioral1
Sample
bc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
bc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe
Resource
win10v2004-20241007-en
General
-
Target
bc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe
-
Size
302KB
-
MD5
aa5e293b4387fe12eaa2fab264b789be
-
SHA1
36e9e145f160ec04e896f9c7cb174cf8899a45dc
-
SHA256
bc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb
-
SHA512
b17fe11219d234c5720cf60c27437af14c46498d5a1c48bbf58c6b1e00f1cc3e93b988b2e669ed743a320042c23173dfcc39429898ca5a803764ad157a9ddc22
-
SSDEEP
6144:+eGlkYytRzWO72BJkaLweWTKG8rWkXYh6n5HtYPq/n0Cae5bfF6Lk9HWVqBPEo26:FYuR6O723kaLnMh653xQLkBWVqBco2tR
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe
Processes
Network
-
Remote address:8.8.8.8:53Requeststoryspaddr.clickIN AResponse
-
Remote address:8.8.8.8:53Requestnearycrepso.shopIN AResponse
-
Remote address:8.8.8.8:53Requestabruptyopsn.shopIN AResponse
-
Remote address:8.8.8.8:53Requestwholersorie.shopIN AResponse
-
Remote address:8.8.8.8:53Requestframekgirus.shopIN AResponse
-
Remote address:8.8.8.8:53Requesttirepublicerj.shopIN AResponse
-
Remote address:8.8.8.8:53Requestnoisycuttej.shopIN AResponse
-
Remote address:8.8.8.8:53Requestrabidcowse.shopIN AResponse
-
Remote address:8.8.8.8:53Requestrabidcowse.shopIN AResponse
-
Remote address:8.8.8.8:53Requestcloudewahsj.shopIN AResponse
-
Remote address:8.8.8.8:53Requeststeamcommunity.comIN AResponsesteamcommunity.comIN A104.124.170.33
-
GEThttps://steamcommunity.com/profiles/76561199724331900bc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exeRemote address:104.124.170.33:443RequestGET /profiles/76561199724331900 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Host: steamcommunity.com
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Date: Sat, 18 Jan 2025 09:24:51 GMT
Content-Length: 35603
Connection: keep-alive
Set-Cookie: sessionid=58b622926dcbe371f6bbcf8d; Path=/; Secure; SameSite=None
Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
-
Remote address:8.8.8.8:53Requestnikolay-romanov.suIN AResponse
-
104.124.170.33:443https://steamcommunity.com/profiles/76561199724331900tls, httpbc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe1.5kB 42.9kB 22 37
HTTP Request
GET https://steamcommunity.com/profiles/76561199724331900HTTP Response
200
-
8.8.8.8:53storyspaddr.clickdnsbc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe63 B 128 B 1 1
DNS Request
storyspaddr.click
-
8.8.8.8:53nearycrepso.shopdnsbc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe62 B 119 B 1 1
DNS Request
nearycrepso.shop
-
8.8.8.8:53abruptyopsn.shopdnsbc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe62 B 119 B 1 1
DNS Request
abruptyopsn.shop
-
8.8.8.8:53wholersorie.shopdnsbc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe62 B 119 B 1 1
DNS Request
wholersorie.shop
-
8.8.8.8:53framekgirus.shopdnsbc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe62 B 119 B 1 1
DNS Request
framekgirus.shop
-
8.8.8.8:53tirepublicerj.shopdnsbc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe64 B 121 B 1 1
DNS Request
tirepublicerj.shop
-
8.8.8.8:53noisycuttej.shopdnsbc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe62 B 119 B 1 1
DNS Request
noisycuttej.shop
-
122 B 236 B 2 2
DNS Request
rabidcowse.shop
DNS Request
rabidcowse.shop
-
8.8.8.8:53cloudewahsj.shopdnsbc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe62 B 119 B 1 1
DNS Request
cloudewahsj.shop
-
8.8.8.8:53steamcommunity.comdnsbc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe64 B 80 B 1 1
DNS Request
steamcommunity.com
DNS Response
104.124.170.33
-
8.8.8.8:53nikolay-romanov.sudnsbc8bbc7fe27c26fc2cc771cabe97fa10968291b43507924b315f74ecb79350cb.exe64 B 125 B 1 1
DNS Request
nikolay-romanov.su
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b