Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2025-03-22...ys.exe

windows7-x64

10

2025-03-22...ys.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 21:25 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe

  • Size

    1.9MB

  • MD5

    11440d40b4dcfc3cf8383f9097433bb8

  • SHA1

    f0f69363ebceee5c5945f44867ab7feb7ea2f57b

  • SHA256

    377031a94559fef772cda1593232a3b2c7fa6ac7ec57dc44a37cacef3cfa2c06

  • SHA512

    36c10cdcd318638aab437a4bdd9e3088d5194dea1359786a960f1d595727f734349104c02cd5fab5258d95591a990ef9e1ec113958e1c81f27eff020b1f1feeb

  • SSDEEP

    24576:87ZGy9+Acpjdv+K3eqA6dj6YU1s20UPxXMP2Wk4AX:+/Sp5AyAXtWk1

Score
10/10
ramnitbankerdiscoveryspywarestealertrojanupxworm

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Ramnit family
    ramnit
  • Drops file in Drivers directory 2 IoCs
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 25 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 38 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthys.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4560
    • C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
      C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4036
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4036 CREDAT:17410 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:6136
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:556
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{afd81f39-58a1-8944-9c51-93f4fe540475}\Rockey4.inf" "9" "4281a14cb" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "C:\Windows\Temp"
      2⤵
      • Manipulates Digital Signatures
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:4196
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{09a5c292-fb34-a944-9d63-dc7bf386e2d3} Global\{7f4d8fa2-c9d6-174d-a381-69eb0ee760d4} C:\Windows\System32\DriverStore\Temp\{18df2e29-3d87-4143-8343-c423c7251659}\Rockey4.inf C:\Windows\System32\DriverStore\Temp\{18df2e29-3d87-4143-8343-c423c7251659}\Rockey4.cat
        3⤵
          PID:3976

    Network

    • flag-us
      DNS
      api.bing.com
      iexplore.exe
      Remote address:
      8.8.8.8:53
      Request
      api.bing.com
      IN A
      Response
      api.bing.com
      IN CNAME
      api-bing-com.e-0001.e-msedge.net
      api-bing-com.e-0001.e-msedge.net
      IN CNAME
      e-0001.e-msedge.net
      e-0001.e-msedge.net
      IN A
      13.107.5.80
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.ax-0001.ax-msedge.net
      g-bing-com.ax-0001.ax-msedge.net
      IN CNAME
      ax-0001.ax-msedge.net
      ax-0001.ax-msedge.net
      IN A
      150.171.27.10
      ax-0001.ax-msedge.net
      IN A
      150.171.28.10
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f29578ad7de8418da4a2d1dff241a83c&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=
      Remote address:
      150.171.27.10:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f29578ad7de8418da4a2d1dff241a83c&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MUID=093F2725204963F839EF329221F26219; domain=.bing.com; expires=Thu, 16-Apr-2026 21:25:10 GMT; path=/; SameSite=None; Secure; Priority=High;
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: F6F8A2F76B6842498EC2BD32F43797B7 Ref B: LON04EDGE0809 Ref C: 2025-03-22T21:25:10Z
      date: Sat, 22 Mar 2025 21:25:09 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=f29578ad7de8418da4a2d1dff241a83c&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=
      Remote address:
      150.171.27.10:443
      Request
      GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=f29578ad7de8418da4a2d1dff241a83c&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=093F2725204963F839EF329221F26219
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MSPTC=djaCAIKrkkoSkmOkBRAgc5nD7B8TzLzpkLwlIg7IXBg; domain=.bing.com; expires=Thu, 16-Apr-2026 21:25:10 GMT; path=/; Partitioned; secure; SameSite=None
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 4AE799D24F82436FAA5E8B7E812B5B72 Ref B: LON04EDGE0809 Ref C: 2025-03-22T21:25:10Z
      date: Sat, 22 Mar 2025 21:25:09 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f29578ad7de8418da4a2d1dff241a83c&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=
      Remote address:
      150.171.27.10:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f29578ad7de8418da4a2d1dff241a83c&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=093F2725204963F839EF329221F26219; MSPTC=djaCAIKrkkoSkmOkBRAgc5nD7B8TzLzpkLwlIg7IXBg
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: FD3ECD8A9D68487A8B330EEBA5EB6ABD Ref B: LON04EDGE0809 Ref C: 2025-03-22T21:25:10Z
      date: Sat, 22 Mar 2025 21:25:09 GMT
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      ax-0001.ax-msedge.net
      ax-0001.ax-msedge.net
      IN A
      150.171.27.10
      ax-0001.ax-msedge.net
      IN A
      150.171.28.10
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239339388234_1IFMMONGOM3EIAZ4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.27.10:443
      Request
      GET /th?id=OADD2.10239339388234_1IFMMONGOM3EIAZ4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 721420
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: D5CBA8B645644632A837033BC4841984 Ref B: LON04EDGE0609 Ref C: 2025-03-22T21:25:45Z
      date: Sat, 22 Mar 2025 21:25:44 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239359734404_1RBLA5UG5KRWGU20H&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.27.10:443
      Request
      GET /th?id=OADD2.10239359734404_1RBLA5UG5KRWGU20H&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 818456
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 361FA17551D64C8E9EE74CE87FC387F7 Ref B: LON04EDGE0609 Ref C: 2025-03-22T21:25:45Z
      date: Sat, 22 Mar 2025 21:25:44 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239339388235_1XAV95DEOU0F3NPNY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      150.171.27.10:443
      Request
      GET /th?id=OADD2.10239339388235_1XAV95DEOU0F3NPNY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 507475
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 442E33C619454451B6ACCC4357BC7A48 Ref B: LON04EDGE0609 Ref C: 2025-03-22T21:25:45Z
      date: Sat, 22 Mar 2025 21:25:44 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239359734403_1QUIFQSNPPFE4TECL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      150.171.27.10:443
      Request
      GET /th?id=OADD2.10239359734403_1QUIFQSNPPFE4TECL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 737279
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: A2653DF47024450CA51E5B39B03ADC6E Ref B: LON04EDGE0609 Ref C: 2025-03-22T21:25:45Z
      date: Sat, 22 Mar 2025 21:25:44 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239360264545_1QMDV0ZFDT4MYHVM6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.27.10:443
      Request
      GET /th?id=OADD2.10239360264545_1QMDV0ZFDT4MYHVM6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 845518
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 077C67C46B5B444BAB4BA5DC07844DF5 Ref B: LON04EDGE0609 Ref C: 2025-03-22T21:25:45Z
      date: Sat, 22 Mar 2025 21:25:44 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239360264546_1VIJ7TSH89LPKUMDM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      150.171.27.10:443
      Request
      GET /th?id=OADD2.10239360264546_1VIJ7TSH89LPKUMDM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 675736
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 647DEC86C8A448A494A14A8586BFDA75 Ref B: LON04EDGE0609 Ref C: 2025-03-22T21:25:46Z
      date: Sat, 22 Mar 2025 21:25:46 GMT
    • flag-us
      DNS
      c.pki.goog
      Remote address:
      8.8.8.8:53
      Request
      c.pki.goog
      IN A
      Response
      c.pki.goog
      IN CNAME
      pki-goog.l.google.com
      pki-goog.l.google.com
      IN A
      142.250.180.3
    • flag-gb
      GET
      http://c.pki.goog/r/r1.crl
      Remote address:
      142.250.180.3:80
      Request
      GET /r/r1.crl HTTP/1.1
      Cache-Control: max-age = 3000
      Connection: Keep-Alive
      Accept: */*
      If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: c.pki.goog
      Response
      HTTP/1.1 304 Not Modified
      Date: Sat, 22 Mar 2025 21:22:22 GMT
      Expires: Sat, 22 Mar 2025 22:12:22 GMT
      Age: 256
      Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
      Cache-Control: public, max-age=3000
      Vary: Accept-Encoding
    • 150.171.27.10:443
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f29578ad7de8418da4a2d1dff241a83c&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=
      tls, http2
      2.0kB
       9.4kB
       22
      19

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f29578ad7de8418da4a2d1dff241a83c&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=f29578ad7de8418da4a2d1dff241a83c&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=f29578ad7de8418da4a2d1dff241a83c&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=

      HTTP Response

      204
    • 150.171.27.10:443
      https://tse1.mm.bing.net/th?id=OADD2.10239360264546_1VIJ7TSH89LPKUMDM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      tls, http2
      154.1kB
       4.5MB
       3252
      3248

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239339388234_1IFMMONGOM3EIAZ4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239359734404_1RBLA5UG5KRWGU20H&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239339388235_1XAV95DEOU0F3NPNY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239359734403_1QUIFQSNPPFE4TECL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239360264545_1QMDV0ZFDT4MYHVM6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239360264546_1VIJ7TSH89LPKUMDM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Response

      200
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls, http2
      1.4kB
       6.9kB
       16
      13
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       6.9kB
       16
      13
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       6.9kB
       16
      13
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       6.9kB
       16
      13
    • 204.79.197.200:443
      ieonline.microsoft.com
      tls, http2
      iexplore.exe
      1.2kB
       8.2kB
       15
      12
    • 142.250.180.3:80
      http://c.pki.goog/r/r1.crl
      http
      384 B
       354 B
       4
      3

      HTTP Request

      GET http://c.pki.goog/r/r1.crl

      HTTP Response

      304
    • 8.8.8.8:53
      api.bing.com
      dns
      iexplore.exe
      58 B
       134 B
       1
      1

      DNS Request

      api.bing.com

      DNS Response

      13.107.5.80

    • 8.8.8.8:53
      g.bing.com
      dns
      56 B
       148 B
       1
      1

      DNS Request

      g.bing.com

      DNS Response

      150.171.27.10
      150.171.28.10

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      62 B
       170 B
       1
      1

      DNS Request

      tse1.mm.bing.net

      DNS Response

      150.171.27.10
      150.171.28.10

    • 8.8.8.8:53
      c.pki.goog
      dns
      56 B
       107 B
       1
      1

      DNS Request

      c.pki.goog

      DNS Response

      142.250.180.3

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
      Filesize

      471B

      MD5

      01fa3211165ca3e0dbd816e5389630bf

      SHA1

      2a6569707c8ea29cbf996a906855470bb7831f48

      SHA256

      ab165a9a5b25e6c05f6f2eac77c9dcc9b4157897524a0be4415cdae9cef5636f

      SHA512

      1848c476ebf00781299715f7c664465a071fa54e3bc14002df35a74aa27667788956bddc4b96b241ea2865f819cf5e33ed7907504a99342c2a0379a0964550ad

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
      Filesize

      412B

      MD5

      f572ef4487b0fbfe1b8765f6cddb8cac

      SHA1

      a649e7ab416988889f95817ce199f0257a54281d

      SHA256

      efaf6bb4ada8ff2afa7d8aef4ab6994884e5e087e9eb505d132b3cbde272875d

      SHA512

      083ddad2feec09e6992ba8f0fe3261ef1309d6c48b2bfe0d9d1686a18b09af6d981bdfc5bef713f14b9fb8d82d8ebb2d042c6a6ffed7a00ffe123a857edd5a91

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\84O89Q0W\suggestions[1].en-US
      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\2025-03-22_11440d40b4dcfc3cf8383f9097433bb8_amadey_icedid_ramnit_rhadamanthysSrv.exe
      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

      Download Submit

    • C:\Windows\SysWOW64\InstDll.dll
      Filesize

      412KB

      MD5

      28777af4daf84f9ad4145f7105e02477

      SHA1

      f2100f4812007a253134d4e134e6208a78263a2c

      SHA256

      7e0f6280add4c6000d6bf548402e849b83047b960ad89be067ae87e4dc103b77

      SHA512

      543e81509693ed6b75f9dbce536ab15f1bcac5f1fc71646b53ac2bafd2af5859add9acf21b247719e2cf6d2974c3c8552a1fb2f13d3f3be428099fc62e62dcad

      Download Submit

    • C:\Windows\Temp\Rockey4.inf
      Filesize

      3KB

      MD5

      3ce2e5aeef01fa93d94868953406856b

      SHA1

      10d56292d022f39d8ceefded624f8522f5bdccfd

      SHA256

      8cf87f05e75dd558eac842ea3eeda9cafe675d4c6d1eaa211c403b7de2e599cb

      SHA512

      ffeb48efa4254d11d398eb6197ec1a8c0ae398d0bd3dd1cd7d3f66fd8f8e252e726b8adcf651c6e2f2bd9a78023151ca2103349bb63f788aef306010f6f983fc

      Download Submit

    • C:\Windows\Temp\Rockey4.sys
      Filesize

      29KB

      MD5

      6b9b088f4921b5114f7916a1cfa90f51

      SHA1

      be3d21cf1a9eae23ff0464f2ee19d60891ba8777

      SHA256

      a3fbfe4c4c5195524107d1127e8165d53319f306e07647022a6557750f0b2c29

      SHA512

      961c9e56bb62098989d55a951da4b05db56d15ca26ca85f9413139f24ae3624056c33d16d711819f1cac97469fa456578fedcd30dde773d87523a29cb337a98d

      Download Submit

    • C:\Windows\Temp\Rockey4USB.sys
      Filesize

      20KB

      MD5

      a215e31da7fc0369e315132303582b5b

      SHA1

      3dbb87e75c01ad93845a6c90602bdcd49f5e1882

      SHA256

      a55c1b52240efb612b0771f35797f2aa68b249be7f7da930a0ee5d8212c7f7a7

      SHA512

      c5d132725c3f41357b517341a28220cf205cba4c49376908b03e8780c6c456db70724f48b3ce89f90edb9e865308a607a41db0571e8e871c503e0ff251ce76a2

      Download Submit

    • C:\Windows\Temp\Ry4CoInst.dll
      Filesize

      6KB

      MD5

      5d1e774106c240e330e7384f8bd2835c

      SHA1

      0e6bfc62067d52540eb84852eb1e160fb646e4d5

      SHA256

      fab2055534c54c8c8d3df3065a481fb8b2d1bc052c29ac500634ba63f32fea09

      SHA512

      48c4d2ac25e8e3f128201cc0503de7cdb952ad849fe760c112bf32ff0e9df96da16fa356ab99f64cb45eb3a4314fc3bfdc852e06a1263c4cd681c7b42b9df578

      Download Submit

    • C:\Windows\Temp\rockey4.cat
      Filesize

      9KB

      MD5

      f5e17a72ecbe8f0556423e796124f785

      SHA1

      60b887c365c0541e0aa1518ac687bc3eb7e60a4c

      SHA256

      d0e390cbe3a1313d0b4348bfdc9da947616fc7dda4ecc414468b5f2151f5b60f

      SHA512

      4f85087d92b2b6494cb2a1d281c34bb72fa6bd9f31d3369aa9729ba12d320618836f2d25dc92dcec18b1c9cfa0f3977bff809d179a988ddacaf67acfe06ea9c4

      Download Submit

    • memory/1824-7-0x0000000000430000-0x000000000043F000-memory.dmp

      Filesize

      60KB

      Download

    • memory/1824-11-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

      Download

    • memory/1824-4-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

      Download

    • memory/2780-18-0x0000000000480000-0x0000000000481000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2780-20-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

      Download

    • memory/2780-19-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

      Download

    • memory/4560-22-0x0000000000400000-0x00000000005F5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/4560-0-0x0000000000400000-0x00000000005F5000-memory.dmp

      Filesize

      2.0MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.