Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 109

PNG image data, 65 x 56, 8-bit/color RGB, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 109
Category:	downloaded
Dump:	chromecache_109.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 65 x 56, 8-bit/color RGB, non-interlaced
Entropy:	4.002585360278503
Encrypted:	false
Ssdeep:	3:yionv//thPlMXo+ll1xl/k4E08up:6v/lhPqJl17Tp
Size:	61
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 110

HTML document, Unicode text, UTF-8 text, with very long lines (40611), with no line terminators

dropped

Details

File:	Chrome Cache Entry: 110
Category:	dropped
Dump:	chromecache_110.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, Unicode text, UTF-8 text, with very long lines (40611), with no line terminators
Entropy:	5.218341709670023
Encrypted:	false
Ssdeep:	768:jRx9o4PK3jv9l8NZRugOK9TI9Qdc2VT5EN1:jRp9OUTIOrVSL
Size:	40689
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 111

PNG image data, 65 x 56, 8-bit/color RGB, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 111
Category:	dropped
Dump:	chromecache_111.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 65 x 56, 8-bit/color RGB, non-interlaced
Entropy:	4.002585360278503
Encrypted:	false
Ssdeep:	3:yionv//thPlMXo+ll1xl/k4E08up:6v/lhPqJl17Tp
Size:	61
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 112

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 112
Category:	dropped
Dump:	chromecache_112.2.dr
ID:	dr_2
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Entropy:	3.990210155325004
Encrypted:	false
Ssdeep:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
Size:	61
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 113

HTML document, ASCII text, with CRLF line terminators

downloaded

Details

File:	Chrome Cache Entry: 113
Category:	downloaded
Dump:	chromecache_113.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with CRLF line terminators
Entropy:	4.678812567774494
Encrypted:	false
Ssdeep:	12:TjeRHVIdtklI5INGlTF5TF5TF5TF5TF5TFK:neRH68iTPTPTPTPTPTc
Size:	552
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 114

HTML document, Unicode text, UTF-8 text, with very long lines (1561)

downloaded

Details

File:	Chrome Cache Entry: 114
Category:	downloaded
Dump:	chromecache_114.2.dr
ID:	dr_11
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1561)
Entropy:	5.1140581442725015
Encrypted:	false
Ssdeep:	192:8GgOuMNNNZeButfKCUMLpCsYXvsbSKYsI9JxGpaekFgA9:8GgsNsBuXpCBKjIfcaekFgA9
Size:	7900
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 115

ASCII text, with very long lines (42690)

downloaded

Details

File:	Chrome Cache Entry: 115
Category:	downloaded
Dump:	chromecache_115.2.dr
ID:	dr_12
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (42690)
Entropy:	5.373060430099094
Encrypted:	false
Ssdeep:	768:PCoL1znQzlLmx0isMILdD9dBvKBI886ifvO95QPcQ+aoh0aKoS4HRGU5KdF:XQzlyx0ipuvKBb95Q5
Size:	42691
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 116

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 116
Category:	downloaded
Dump:	chromecache_116.2.dr
ID:	dr_13
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Entropy:	3.990210155325004
Encrypted:	false
Ssdeep:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
Size:	61
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 117

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 117
Category:	downloaded
Dump:	chromecache_117.2.dr
ID:	dr_14
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	4.619770731844525
Encrypted:	false
Ssdeep:	6:hxLMmyr5EdxqXCrHFWyh1L203OTxBVWR7qa0XyN3hO97KG4Qb:hKd4x5DsyhslhWRWUfpNQb
Size:	286
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	5576
Target ID:	0
Parent PID:	3732
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	19:10:14
Date:	04/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1884,i,16893877309678579397,15265903318503389045,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3300
Target ID:	2
Parent PID:	5576
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1884,i,16893877309678579397,15265903318503389045,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	19:10:16
Date:	04/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rb.gy/zsqpja"

Details

Is windows:	true
Is dropped:	false
PID:	6496
Target ID:	3
Parent PID:	3732
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rb.gy/zsqpja"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	19:10:19
Date:	04/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://rb.gy/zsqpja

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/89e2c9eedc1343f7/1720134630033/2Wmk4aCUnkOuFYA

104.17.3.184

https://html.duckduckgo.com/html"

unknown

http://italysecret.top/favicon.ico

84.38.180.109

https://kuyqt.bartiletti.top/lfzcq

https://kuyqt.bartiletti.top/favicon.ico

188.114.96.3

https://a.nel.cloudflare.com/report/v4?s=SXj%2FhghnVbR4ct3b1Ht6ze3QF6SuLgxxI5NoErAqWYUYcJwTEKYMJenxfJjsvb%2FLzPxdA9RBSeyywL2o%2FVxNFLyHzFq2OsqI5NwUzohx6XX5KiVYAL9qz2ByanGRVgWovLhXsyJc2Q%3D%3D

35.190.80.1

https://a.nel.cloudflare.com/report/v4?s=z96S4gfhZB6e%2FDAncvUJLvB%2F4wUXyhVJFoClzX3JCv%2F7YhbReLueVEmF87Uf6sYzlXqVXXbNs64Sgmxm2zquvCoctUGqr9m0BP0rXSDgfD7naUihOG7fUiDDbFMwDvFWSD2B%2FZPGAw%3D%3D

35.190.80.1

https://kuyqt.bartiletti.top/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=89e2c9d20c8c42b3

188.114.96.3

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=89e2c9eedc1343f7

104.17.3.184

https://rb.gy/zsqpja

18.211.218.206

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/337380323:1720131764:3U-bWoxIs3jWTCggjO22T6HlsPiNyCLI70JGmCur7Ao/89e2c9eedc1343f7/67489d60c27b9f0

104.17.3.184

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/h67uw/0x4AAAAAAADnPIDROrmt1Wwj/light/normal

http://italysecret.top/contactos

https://duckduckgo.com/assets/logo_social-media.png

unknown

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D

104.17.3.184

https://duckduckgo.com/

40.114.177.156

https://duckduckgo.com/?smartbanner=1

unknown

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/89e2c9eedc1343f7/1720134630033/05855dfb9a155360ad354c02224ed04974d56d328f6298a1833806f5e5fc0f6e/4mmKYehRztd3Q7R

104.17.3.184

https://kuyqt.bartiletti.top/cdn-cgi/challenge-platform/h/g/flow/ov1/1698877250:1720131768:IQLj5zWhM2e9FZTEdQHhsc6E9uLFO5ioD3vxzR41b6I/89e2c9d20c8c42b3/ca3053328c203be

188.114.96.3

https://duckduckgo.com

unknown

There are 10 hidden URLs, click here to show them.

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.210.172

kuyqt.bartiletti.top

188.114.96.3

Details

Name:	kuyqt.bartiletti.top
IP:	188.114.96.3
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
HTML page contains hidden URLs or javascript code	Phishing
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

a.nel.cloudflare.com

35.190.80.1

Details

Name:	a.nel.cloudflare.com
IP:	35.190.80.1
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

italysecret.top

84.38.180.109

Details

Name:	italysecret.top
IP:	84.38.180.109
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

rb.gy

18.211.218.206

Details

Name:	rb.gy
IP:	18.211.218.206
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

challenges.cloudflare.com

104.17.2.184

Details

Name:	challenges.cloudflare.com
IP:	104.17.2.184
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

duckduckgo.com

40.114.177.156

Details

Name:	duckduckgo.com
IP:	40.114.177.156
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

www.google.com

142.250.185.132

Details

Name:	www.google.com
IP:	142.250.185.132
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

fp2e7a.wpc.phicdn.net

192.229.221.95

IPs

Domain

Country

Malicious

142.250.185.132

www.google.com

United States

40.114.177.156

duckduckgo.com

United States

192.168.2.4

unknown

104.17.3.184

unknown

United States

18.211.218.206

rb.gy

United States

239.255.255.250

unknown

Reserved

188.114.96.3

kuyqt.bartiletti.top

European Union

35.190.80.1

a.nel.cloudflare.com

United States

104.17.2.184

challenges.cloudflare.com

United States

84.38.180.109

italysecret.top

Russian Federation

DOM / HTML

URL

Malicious

https://kuyqt.bartiletti.top/lfzcq

Details

Filename:	0.5.pages.html.dom
Url:	https://kuyqt.bartiletti.top/lfzcq
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1884,i,16893877309678579397,15265903318503389045,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected HtmlPhish44	Phishing

https://kuyqt.bartiletti.top/lfzcq

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/h67uw/0x4AAAAAAADnPIDROrmt1Wwj/light/normal

http://italysecret.top/contactos

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://rb.gy/zsqpja

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://rb.gy/zsqpja

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://rb.gy/zsqpja