Overview

overview

10

Static

static

3

891a8f1284...45.exe

windows7-x64

10

891a8f1284...45.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2025, 23:46 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    891a8f128440e08a34379b6b9c0674dd2600d82efe911136c5ce001bbb695e45.exe

  • Size

    1.8MB

  • MD5

    94bbf82d89ccb6b454a3fe7db782a998

  • SHA1

    e92f16d611e82e471d763a4a8f4fcb9421baf769

  • SHA256

    891a8f128440e08a34379b6b9c0674dd2600d82efe911136c5ce001bbb695e45

  • SHA512

    5ec961bdfc6c7a0465ff8bc5fe2f9cddc69795a08123a654226f1b42c31dd64f2aaca188088f57e779ce2518764378fd5d9f48f327ca6cf5c5ba23c0fa1c7180

  • SSDEEP

    24576:7QZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cV0Tdy764qNGg7MQT:7QZAdVyVT9n/Gg0P+WhoC64qNp7

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Signatures

  • Detect PurpleFox Rootkit 11 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 12 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Purplefox family
    purplefox
  • Drops file in Drivers directory 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 6 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\891a8f128440e08a34379b6b9c0674dd2600d82efe911136c5ce001bbb695e45.exe
    "C:\Users\Admin\AppData\Local\Temp\891a8f128440e08a34379b6b9c0674dd2600d82efe911136c5ce001bbb695e45.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\\svchost.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4236
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:3756
    • C:\Users\Admin\AppData\Local\Temp\svchos.exe
      C:\Users\Admin\AppData\Local\Temp\\svchos.exe
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:2684
  • C:\Windows\SysWOW64\TXPlatforn.exe
    C:\Windows\SysWOW64\TXPlatforn.exe -auto
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Windows\SysWOW64\TXPlatforn.exe
      C:\Windows\SysWOW64\TXPlatforn.exe -acsi
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:5116
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
    1⤵
      PID:2120
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
        C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240619359.txt",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3304

    Network

    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      181.129.81.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      181.129.81.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      4.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      4.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      218.99.81.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      218.99.81.104.in-addr.arpa
      IN PTR
      Response
      218.99.81.104.in-addr.arpa
      IN PTR
      a104-81-99-218deploystaticakamaitechnologiescom
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      196.249.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.249.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      200.163.202.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      200.163.202.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      19.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      hackerinvasion.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      hackerinvasion.f3322.net
      IN A
      Response
    • flag-us
      DNS
      59.189.79.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      59.189.79.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      59.189.79.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      59.189.79.40.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      181.129.81.91.in-addr.arpa
      dns
      72 B
       147 B
       1
      1

      DNS Request

      181.129.81.91.in-addr.arpa

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      4.159.190.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      4.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      218.99.81.104.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      218.99.81.104.in-addr.arpa

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      196.249.167.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      196.249.167.52.in-addr.arpa

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      200.163.202.172.in-addr.arpa
      dns
      74 B
       160 B
       1
      1

      DNS Request

      200.163.202.172.in-addr.arpa

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      19.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      19.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      70 B
       131 B
       1
      1

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      140 B
       262 B
       2
      2

      DNS Request

      hackerinvasion.f3322.net

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      140 B
       262 B
       2
      2

      DNS Request

      hackerinvasion.f3322.net

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      140 B
       262 B
       2
      2

      DNS Request

      hackerinvasion.f3322.net

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      140 B
       262 B
       2
      2

      DNS Request

      hackerinvasion.f3322.net

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      140 B
       262 B
       2
      2

      DNS Request

      hackerinvasion.f3322.net

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      140 B
       262 B
       2
      2

      DNS Request

      hackerinvasion.f3322.net

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      hackerinvasion.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      140 B
       262 B
       2
      2

      DNS Request

      hackerinvasion.f3322.net

      DNS Request

      hackerinvasion.f3322.net

    • 8.8.8.8:53
      59.189.79.40.in-addr.arpa
      dns
      142 B
       290 B
       2
      2

      DNS Request

      59.189.79.40.in-addr.arpa

      DNS Request

      59.189.79.40.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\HD_X.dat
      Filesize

      1.8MB

      MD5

      94bbf82d89ccb6b454a3fe7db782a998

      SHA1

      e92f16d611e82e471d763a4a8f4fcb9421baf769

      SHA256

      891a8f128440e08a34379b6b9c0674dd2600d82efe911136c5ce001bbb695e45

      SHA512

      5ec961bdfc6c7a0465ff8bc5fe2f9cddc69795a08123a654226f1b42c31dd64f2aaca188088f57e779ce2518764378fd5d9f48f327ca6cf5c5ba23c0fa1c7180

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\svchos.exe
      Filesize

      93KB

      MD5

      3b377ad877a942ec9f60ea285f7119a2

      SHA1

      60b23987b20d913982f723ab375eef50fafa6c70

      SHA256

      62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84

      SHA512

      af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      Filesize

      377KB

      MD5

      a4329177954d4104005bce3020e5ef59

      SHA1

      23c29e295e2dbb8454012d619ca3f81e4c16e85a

      SHA256

      6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd

      SHA512

      81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

      Download Submit

    • C:\Windows\SysWOW64\240619359.txt
      Filesize

      50KB

      MD5

      8bfaf95a91bb68fcad82f620acddf9cd

      SHA1

      73a4311cb21bfd2d6774070949b2862ead6ee93d

      SHA256

      9d47edd6e358c00fb1bf40126634eba289898a04d239b1efcd54482acd7f139f

      SHA512

      761780dc8c6d96c201e6414ded71ed4fa6d077d787317abc37bb51f9a8fe1a1391f259edba4675291071e7fe66f15b8646773d922e85d5b605d27ec3fb8385de

      Download Submit

    • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Filesize

      60KB

      MD5

      889b99c52a60dd49227c5e485a016679

      SHA1

      8fa889e456aa646a4d0a4349977430ce5fa5e2d7

      SHA256

      6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

      SHA512

      08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

      Download Submit

    • memory/2444-10-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2444-6-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2444-7-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/2444-4-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/3400-16-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/3400-18-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/3400-14-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/3400-27-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/3400-15-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/5116-26-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/5116-83-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/5116-86-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    • memory/5116-88-0x0000000010000000-0x00000000101B6000-memory.dmp

      Filesize

      1.7MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.