Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2025, 08:01 UTC

General

  • Target

    rEFT-RemittanceforOverdueInvoice.exe

  • Size

    1.2MB

  • MD5

    4356632cd55a6b5f7b9f49dc17ccee00

  • SHA1

    174bffb9781b6f4e455bba193a6921f57bc7f079

  • SHA256

    62c6436c72f6e31fe3598b4e79600f6262a5fcce63fe6a780e6644669f2b5e63

  • SHA512

    4db5ddf36fc19e3389f4d2b24d0a4e5cf923a8a43fd57e5b61b5d1522a70215615a58ad5a605b9dbc6f5f112db06b2902bd6fdb0811d322565ecda2fbf6fc382

  • SSDEEP

    24576:RAHnh+eWsN3skA4RV1Hom2KXFmIakcPGVsvv9BcdHy+oOZ7d8N5:oh+ZkldoPK1XakcPGVsnTc9iIpq

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.norcalwholehousefans.com
  • Port:
    587
  • Username:
    info@norcalwholehousefans.com
  • Password:
    Pythonk2024!@#$

Extracted

Family

vipkeylogger

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rEFT-RemittanceforOverdueInvoice.exe
    "C:\Users\Admin\AppData\Local\Temp\rEFT-RemittanceforOverdueInvoice.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Users\Admin\AppData\Local\Okeghem\subbasaltic.exe
      "C:\Users\Admin\AppData\Local\Temp\rEFT-RemittanceforOverdueInvoice.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\rEFT-RemittanceforOverdueInvoice.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2616

Network

  • flag-us
    DNS
    checkip.dyndns.org
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    checkip.dyndns.org
    IN A
    Response
    checkip.dyndns.org
    IN CNAME
    checkip.dyndns.com
    checkip.dyndns.com
    IN A
    132.226.247.73
    checkip.dyndns.com
    IN A
    193.122.130.0
    checkip.dyndns.com
    IN A
    132.226.8.169
    checkip.dyndns.com
    IN A
    158.101.44.242
    checkip.dyndns.com
    IN A
    193.122.6.168
  • flag-br
    GET
    http://checkip.dyndns.org/
    RegSvcs.exe
    Remote address:
    132.226.247.73:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:15 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-br
    GET
    http://checkip.dyndns.org/
    RegSvcs.exe
    Remote address:
    132.226.247.73:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:18 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-br
    GET
    http://checkip.dyndns.org/
    RegSvcs.exe
    Remote address:
    132.226.247.73:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:24 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-br
    GET
    http://checkip.dyndns.org/
    RegSvcs.exe
    Remote address:
    132.226.247.73:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:28 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-br
    GET
    http://checkip.dyndns.org/
    RegSvcs.exe
    Remote address:
    132.226.247.73:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:31 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-br
    GET
    http://checkip.dyndns.org/
    RegSvcs.exe
    Remote address:
    132.226.247.73:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:34 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-br
    GET
    http://checkip.dyndns.org/
    RegSvcs.exe
    Remote address:
    132.226.247.73:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:37 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-br
    GET
    http://checkip.dyndns.org/
    RegSvcs.exe
    Remote address:
    132.226.247.73:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:40 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-br
    GET
    http://checkip.dyndns.org/
    RegSvcs.exe
    Remote address:
    132.226.247.73:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:43 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-br
    GET
    http://checkip.dyndns.org/
    RegSvcs.exe
    Remote address:
    132.226.247.73:80
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
    Host: checkip.dyndns.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:46 GMT
    Content-Type: text/html
    Content-Length: 106
    Connection: keep-alive
    Cache-Control: no-cache
    Pragma: no-cache
  • flag-us
    DNS
    reallyfreegeoip.org
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    reallyfreegeoip.org
    IN A
    Response
    reallyfreegeoip.org
    IN A
    104.21.112.1
    reallyfreegeoip.org
    IN A
    104.21.80.1
    reallyfreegeoip.org
    IN A
    104.21.32.1
    reallyfreegeoip.org
    IN A
    104.21.16.1
    reallyfreegeoip.org
    IN A
    104.21.64.1
    reallyfreegeoip.org
    IN A
    104.21.48.1
    reallyfreegeoip.org
    IN A
    104.21.96.1
  • flag-us
    GET
    https://reallyfreegeoip.org/xml/181.215.176.83
    RegSvcs.exe
    Remote address:
    104.21.112.1:443
    Request
    GET /xml/181.215.176.83 HTTP/1.1
    Host: reallyfreegeoip.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:21 GMT
    Content-Type: text/xml
    Content-Length: 356
    Connection: keep-alive
    Cache-Control: max-age=31536000
    CF-Cache-Status: HIT
    Age: 6625135
    Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
    Accept-Ranges: bytes
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uErBUXnAjowveLo8rr0cl7ls5YOV%2Bub5ZVcCBiw82dNtds1WgH5zzOFny9NuuikcqbOG2rluE9opYnY3H6y0GKNWcTUARsEtkzTeNZLTkEKioJt3g1tnHmkI0DIzEXR%2FIksdN8BZ"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9097b19abb16957e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=52590&min_rtt=47324&rtt_var=20047&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2865&recv_bytes=374&delivery_rate=74539&cwnd=253&unsent_bytes=0&cid=aff72a2ae6dc709a&ts=153&x=0"
  • flag-us
    GET
    https://reallyfreegeoip.org/xml/181.215.176.83
    RegSvcs.exe
    Remote address:
    104.21.112.1:443
    Request
    GET /xml/181.215.176.83 HTTP/1.1
    Host: reallyfreegeoip.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:24 GMT
    Content-Type: text/xml
    Content-Length: 356
    Connection: keep-alive
    Cache-Control: max-age=31536000
    CF-Cache-Status: HIT
    Age: 6625138
    Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
    Accept-Ranges: bytes
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fL1S6ySbRthIwZDRxJU%2FwK%2BMVOo92nwOP0ipk8HkS2y%2FrqNZhXQDUUhcczGlzf8ksZocwuHypDrAvJrkf%2FNdwJMJirvFBGcILpocex6KvM2DowiQz7FhDrMiHLVBP%2B7KyW%2BWD%2Bkq"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9097b1b31b46957e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=77529&min_rtt=47324&rtt_var=64913&sent=6&recv=8&lost=0&retrans=0&sent_bytes=4134&recv_bytes=475&delivery_rate=74539&cwnd=254&unsent_bytes=0&cid=aff72a2ae6dc709a&ts=4051&x=0"
  • flag-us
    GET
    https://reallyfreegeoip.org/xml/181.215.176.83
    RegSvcs.exe
    Remote address:
    104.21.112.1:443
    Request
    GET /xml/181.215.176.83 HTTP/1.1
    Host: reallyfreegeoip.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:28 GMT
    Content-Type: text/xml
    Content-Length: 356
    Connection: keep-alive
    Cache-Control: max-age=31536000
    CF-Cache-Status: HIT
    Age: 6625142
    Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
    Accept-Ranges: bytes
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rpW0WgsOxI6tlf4OFBdT2y2%2FArZxnFioNL%2Fov7YXOLi%2FQNtHMa0S%2BfSuAT4afSH4ez6c6KtuphFSNmgmp75gDSasr1cUW8fCWMMFTInzpRLYQ9ZkYrZU3MBWD3c6depI2shtara8"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9097b1cb7d19957e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=99543&min_rtt=47324&rtt_var=92713&sent=7&recv=10&lost=0&retrans=0&sent_bytes=5419&recv_bytes=576&delivery_rate=74539&cwnd=255&unsent_bytes=0&cid=aff72a2ae6dc709a&ts=7949&x=0"
  • flag-us
    GET
    https://reallyfreegeoip.org/xml/181.215.176.83
    RegSvcs.exe
    Remote address:
    104.21.112.1:443
    Request
    GET /xml/181.215.176.83 HTTP/1.1
    Host: reallyfreegeoip.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:31 GMT
    Content-Type: text/xml
    Content-Length: 356
    Connection: keep-alive
    Cache-Control: max-age=31536000
    CF-Cache-Status: HIT
    Age: 6625145
    Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
    Accept-Ranges: bytes
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E9Yl5CNHKFZg7gHsGGk7i0kSMj1%2F1kNoi5q3fPXesEmjbpEODB9MniLl4BoBGEk5EymDVIJXwSyL%2FEwwTSW49BqYcZqi%2BJBwI4MCFMGf4GEvmNFO2Te7UHXCkGZl4WEZ%2FXvsYjtT"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9097b1dd99da957e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=119123&min_rtt=47324&rtt_var=108694&sent=8&recv=12&lost=0&retrans=0&sent_bytes=6704&recv_bytes=677&delivery_rate=74539&cwnd=256&unsent_bytes=0&cid=aff72a2ae6dc709a&ts=10852&x=0"
  • flag-us
    GET
    https://reallyfreegeoip.org/xml/181.215.176.83
    RegSvcs.exe
    Remote address:
    104.21.112.1:443
    Request
    GET /xml/181.215.176.83 HTTP/1.1
    Host: reallyfreegeoip.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:34 GMT
    Content-Type: text/xml
    Content-Length: 356
    Connection: keep-alive
    Cache-Control: max-age=31536000
    CF-Cache-Status: HIT
    Age: 6625148
    Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
    Accept-Ranges: bytes
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=npu%2FI0AA1wdimn7n2a1XDBslrV3Ifu4DpT2sMel6A04D1O8Bu4mn5ZKZ3fDMYsQ5WIVUJxIyaNV4EOQ%2BbRkH6Ho3gf57M56IJqTVbYFQJ%2BpKLqKrYIcvXj2Sw57ZpATD0ExSv2ja"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9097b1efba42957e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=134097&min_rtt=47324&rtt_var=111469&sent=9&recv=14&lost=0&retrans=0&sent_bytes=7989&recv_bytes=778&delivery_rate=74539&cwnd=257&unsent_bytes=0&cid=aff72a2ae6dc709a&ts=13748&x=0"
  • flag-us
    GET
    https://reallyfreegeoip.org/xml/181.215.176.83
    RegSvcs.exe
    Remote address:
    104.21.112.1:443
    Request
    GET /xml/181.215.176.83 HTTP/1.1
    Host: reallyfreegeoip.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:37 GMT
    Content-Type: text/xml
    Content-Length: 356
    Connection: keep-alive
    Cache-Control: max-age=31536000
    CF-Cache-Status: HIT
    Age: 6625151
    Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
    Accept-Ranges: bytes
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A%2Fsg6L2MidOCjjWVc7IX040Fk%2FyC%2FoWTjZbs6fnDMDwRotb%2B9vI2qoqJQcBJfy3fQ%2BfFeZJQIhCMzkZpj0i6FVZsCP2aIUOQx0rku41IT9K3JhtVLQLvMrIxeV2TH1xJzGxvsuGW"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9097b201cc65957e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=150074&min_rtt=47324&rtt_var=115555&sent=10&recv=16&lost=0&retrans=0&sent_bytes=9274&recv_bytes=879&delivery_rate=74539&cwnd=257&unsent_bytes=0&cid=aff72a2ae6dc709a&ts=16634&x=0"
  • flag-us
    GET
    https://reallyfreegeoip.org/xml/181.215.176.83
    RegSvcs.exe
    Remote address:
    104.21.112.1:443
    Request
    GET /xml/181.215.176.83 HTTP/1.1
    Host: reallyfreegeoip.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:40 GMT
    Content-Type: text/xml
    Content-Length: 356
    Connection: keep-alive
    Cache-Control: max-age=31536000
    CF-Cache-Status: HIT
    Age: 6625154
    Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
    Accept-Ranges: bytes
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cMsOXHOl4dzpK3ehH5obbiSAfx9TDi64KXXeI%2FefXM22bxnHOvjzIfMN447VpmSd%2BmWAvu3SEkmawQg%2FKYc4TotbKrYgRDb8diZ5AFJJ7HK6epfbbcQi2hDG056SJVm%2BDD%2FhMtHg"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9097b213e8bd957e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=163840&min_rtt=47324&rtt_var=114199&sent=11&recv=18&lost=0&retrans=0&sent_bytes=10559&recv_bytes=980&delivery_rate=74539&cwnd=257&unsent_bytes=0&cid=aff72a2ae6dc709a&ts=19534&x=0"
  • flag-us
    GET
    https://reallyfreegeoip.org/xml/181.215.176.83
    RegSvcs.exe
    Remote address:
    104.21.112.1:443
    Request
    GET /xml/181.215.176.83 HTTP/1.1
    Host: reallyfreegeoip.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:43 GMT
    Content-Type: text/xml
    Content-Length: 356
    Connection: keep-alive
    Cache-Control: max-age=31536000
    CF-Cache-Status: HIT
    Age: 6625157
    Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
    Accept-Ranges: bytes
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8g98K4J%2FcZfS3XXnW9FOYLFx0HEhyQkPedywDFXQXfbgz2cvR1v45ledgMfOsMZQTWskyjeTkIIb6U5Pr1pgKzIV6jkEwtLF1RqmJBhIG6ltIGVswF8lnzv1w%2BOosrhsQXgpYR7G"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9097b225eab4957e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=176035&min_rtt=47324&rtt_var=110039&sent=12&recv=20&lost=0&retrans=0&sent_bytes=11844&recv_bytes=1081&delivery_rate=74539&cwnd=257&unsent_bytes=0&cid=aff72a2ae6dc709a&ts=22420&x=0"
  • flag-us
    GET
    https://reallyfreegeoip.org/xml/181.215.176.83
    RegSvcs.exe
    Remote address:
    104.21.112.1:443
    Request
    GET /xml/181.215.176.83 HTTP/1.1
    Host: reallyfreegeoip.org
    Response
    HTTP/1.1 200 OK
    Date: Wed, 29 Jan 2025 08:01:46 GMT
    Content-Type: text/xml
    Content-Length: 356
    Connection: keep-alive
    Cache-Control: max-age=31536000
    CF-Cache-Status: HIT
    Age: 6625160
    Last-Modified: Wed, 13 Nov 2024 15:42:26 GMT
    Accept-Ranges: bytes
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rgfnycKh8k0TjFY%2F9ngEvMeaV771kTJf8Ao0ob577H8NtrFQq%2FWxPDGSVVmuhhf6%2FG%2B6rxvviG4cq1fPiabOWJx%2FDwqqMaghgSis3KlvXiIgM8KV5fCkzFhBpmCsLwrNb6Tzsp8m"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9097b237ffab957e-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=184768&min_rtt=47324&rtt_var=99996&sent=13&recv=22&lost=0&retrans=0&sent_bytes=13129&recv_bytes=1182&delivery_rate=74539&cwnd=257&unsent_bytes=0&cid=aff72a2ae6dc709a&ts=25307&x=0"
  • flag-us
    DNS
    api.telegram.org
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    api.telegram.org
    IN A
    Response
    api.telegram.org
    IN A
    149.154.167.220
  • flag-us
    DNS
    mail.norcalwholehousefans.com
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.norcalwholehousefans.com
    IN A
    Response
    mail.norcalwholehousefans.com
    IN A
    162.144.15.77
  • 132.226.247.73:80
    http://checkip.dyndns.org/
    http
    RegSvcs.exe
    2.4kB
    3.4kB
    25
    17

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200

    HTTP Request

    GET http://checkip.dyndns.org/

    HTTP Response

    200
  • 104.21.112.1:443
    https://reallyfreegeoip.org/xml/181.215.176.83
    tls, http
    RegSvcs.exe
    2.3kB
    15.1kB
    25
    16

    HTTP Request

    GET https://reallyfreegeoip.org/xml/181.215.176.83

    HTTP Response

    200

    HTTP Request

    GET https://reallyfreegeoip.org/xml/181.215.176.83

    HTTP Response

    200

    HTTP Request

    GET https://reallyfreegeoip.org/xml/181.215.176.83

    HTTP Response

    200

    HTTP Request

    GET https://reallyfreegeoip.org/xml/181.215.176.83

    HTTP Response

    200

    HTTP Request

    GET https://reallyfreegeoip.org/xml/181.215.176.83

    HTTP Response

    200

    HTTP Request

    GET https://reallyfreegeoip.org/xml/181.215.176.83

    HTTP Response

    200

    HTTP Request

    GET https://reallyfreegeoip.org/xml/181.215.176.83

    HTTP Response

    200

    HTTP Request

    GET https://reallyfreegeoip.org/xml/181.215.176.83

    HTTP Response

    200

    HTTP Request

    GET https://reallyfreegeoip.org/xml/181.215.176.83

    HTTP Response

    200
  • 149.154.167.220:443
    api.telegram.org
    tls
    RegSvcs.exe
    388 B
    219 B
    5
    5
  • 162.144.15.77:587
    mail.norcalwholehousefans.com
    smtp-submission
    RegSvcs.exe
    3.9kB
    1.2kB
    22
    16
  • 8.8.8.8:53
    checkip.dyndns.org
    dns
    RegSvcs.exe
    64 B
    176 B
    1
    1

    DNS Request

    checkip.dyndns.org

    DNS Response

    132.226.247.73
    193.122.130.0
    132.226.8.169
    158.101.44.242
    193.122.6.168

  • 8.8.8.8:53
    reallyfreegeoip.org
    dns
    RegSvcs.exe
    65 B
    177 B
    1
    1

    DNS Request

    reallyfreegeoip.org

    DNS Response

    104.21.112.1
    104.21.80.1
    104.21.32.1
    104.21.16.1
    104.21.64.1
    104.21.48.1
    104.21.96.1

  • 8.8.8.8:53
    api.telegram.org
    dns
    RegSvcs.exe
    62 B
    78 B
    1
    1

    DNS Request

    api.telegram.org

    DNS Response

    149.154.167.220

  • 8.8.8.8:53
    mail.norcalwholehousefans.com
    dns
    RegSvcs.exe
    75 B
    91 B
    1
    1

    DNS Request

    mail.norcalwholehousefans.com

    DNS Response

    162.144.15.77

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\acrorrheuma

    Filesize

    58KB

    MD5

    b9a485779d92c262494f8fd79fa24e55

    SHA1

    b1258dd5f1145c1c4e63a18165602c1deebf3004

    SHA256

    a53d6ab162ddd45cef65112e4b2ec1e0fd8cd6307a1667a6b2fd664c7a853f79

    SHA512

    bc3511fc6e55ac9eb0f840cfdd218eb97c7a9a47e77024b658867b97fadc9ad27269070bf6e0ba5770c41196ad0ad550bccc40d25847c8e7151bf750efeba90d

  • \Users\Admin\AppData\Local\Okeghem\subbasaltic.exe

    Filesize

    1.2MB

    MD5

    4356632cd55a6b5f7b9f49dc17ccee00

    SHA1

    174bffb9781b6f4e455bba193a6921f57bc7f079

    SHA256

    62c6436c72f6e31fe3598b4e79600f6262a5fcce63fe6a780e6644669f2b5e63

    SHA512

    4db5ddf36fc19e3389f4d2b24d0a4e5cf923a8a43fd57e5b61b5d1522a70215615a58ad5a605b9dbc6f5f112db06b2902bd6fdb0811d322565ecda2fbf6fc382

  • memory/1700-11-0x00000000007A0000-0x0000000000BA0000-memory.dmp

    Filesize

    4.0MB

  • memory/2616-95-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-97-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-35-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2616-36-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2616-37-0x00000000740FE000-0x00000000740FF000-memory.dmp

    Filesize

    4KB

  • memory/2616-38-0x00000000005F0000-0x0000000000650000-memory.dmp

    Filesize

    384KB

  • memory/2616-39-0x00000000740F0000-0x00000000747DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2616-40-0x0000000000BD0000-0x0000000000C2E000-memory.dmp

    Filesize

    376KB

  • memory/2616-41-0x00000000740F0000-0x00000000747DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2616-42-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-43-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-45-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-47-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-87-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-75-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-89-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-1143-0x00000000740F0000-0x00000000747DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2616-236-0x00000000740F0000-0x00000000747DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2616-101-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-99-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-1146-0x00000000740F0000-0x00000000747DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2616-93-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-33-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2616-91-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-51-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-85-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-83-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-81-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-79-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-77-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-73-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-71-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-69-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-67-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-65-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-63-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-61-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-59-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-57-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-55-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-53-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-49-0x0000000000BD0000-0x0000000000C29000-memory.dmp

    Filesize

    356KB

  • memory/2616-1144-0x00000000740FE000-0x00000000740FF000-memory.dmp

    Filesize

    4KB

  • memory/2616-1145-0x00000000740F0000-0x00000000747DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2952-31-0x00000000006B0000-0x0000000000AB0000-memory.dmp

    Filesize

    4.0MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.