Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 134

Web Open Font Format (Version 2), TrueType, length 18668, version 1.0

downloaded

Details

File:	Chrome Cache Entry: 134
Category:	downloaded
Dump:	chromecache_134.3.dr
ID:	dr_5
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Web Open Font Format (Version 2), TrueType, length 18668, version 1.0
Entropy:	7.988119248989337
Encrypted:	false
Ssdeep:	384:1stcBfAVaR8i6XzMsb4fcjakBudFyBqrgeU0hipgwfqj09nOt/a:1k0F6Xz1bFjaPbyBqr9hIgkM3Fa
Size:	18668
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 135

PNG image data, 300 x 908, 8-bit/color RGBA, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 135
Category:	dropped
Dump:	chromecache_135.3.dr
ID:	dr_1
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 300 x 908, 8-bit/color RGBA, non-interlaced
Entropy:	7.943324151637908
Encrypted:	false
Ssdeep:	384:0VJ2SWdM0zUbge+VBn+bZYBB0xMHOhHvpO2YbK4GKajJ/ts1Zql+8Qd6NFs:0VJ2SW3AbA0xxFw3ZaeUI8TFs
Size:	24351
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 136

PNG image data, 300 x 908, 8-bit/color RGBA, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 136
Category:	downloaded
Dump:	chromecache_136.3.dr
ID:	dr_6
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 300 x 908, 8-bit/color RGBA, non-interlaced
Entropy:	7.943324151637908
Encrypted:	false
Ssdeep:	384:0VJ2SWdM0zUbge+VBn+bZYBB0xMHOhHvpO2YbK4GKajJ/ts1Zql+8Qd6NFs:0VJ2SW3AbA0xxFw3ZaeUI8TFs
Size:	24351
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 137

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 137
Category:	downloaded
Dump:	chromecache_137.3.dr
ID:	dr_7
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	4.589059888041022
Encrypted:	false
Ssdeep:	48:80GA3MDbEGSenRSBLNAqoidcnBVsejgau:80D3sbEGxnRGNADocnBljhu
Size:	1913
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 138

ASCII text, with very long lines (1572)

downloaded

Details

File:	Chrome Cache Entry: 138
Category:	downloaded
Dump:	chromecache_138.3.dr
ID:	dr_8
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (1572)
Entropy:	5.385847419693263
Encrypted:	false
Ssdeep:	96:ZOEMJJOEMiDFZ8OEMXkOEMhYOEMlOEM5y+aZjzBrWOEMfubqGIFuV4UOEMmOEMZ0:wJAiXBh1s5qb2bqGIwV4R3ZqF
Size:	5973
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	6216
Target ID:	1
Parent PID:	5864
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	02:02:22
Date:	26/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2168,i,11221259460610057314,13659175793779925463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	4328
Target ID:	3
Parent PID:	6216
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2168,i,11221259460610057314,13659175793779925463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	02:02:26
Date:	26/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://2fa.telefon-de.com"

Details

Is windows:	true
Is dropped:	false
PID:	5388
Target ID:	4
Parent PID:	5864
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://2fa.telefon-de.com"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	02:02:29
Date:	26/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://2fa.telefon-de.com

https://2fa.telefon-de.com/favicon.ico

54.154.95.205

https://tse1.mm.bing.net/th?id=OADD2.10239381875620_105WFGICYAOBXCJJA&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

150.171.27.10

https://tse1.mm.bing.net/th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

150.171.27.10

http://2fa.telefon-de.com/

46.137.49.168

https://tse1.mm.bing.net/th?id=OADD2.10239340418597_1J0EQ8ZTOVJVXHV7G&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

150.171.27.10

https://tse1.mm.bing.net/th?id=OADD2.10239381875621_18WKHVUE81K5HM47F&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

150.171.27.10

https://2fa.telefon-de.com/img/404-stu.png

54.154.95.205

https://tse1.mm.bing.net/th?id=OADD2.10239340418598_1HURUV6S4V3U642BB&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

150.171.27.10

https://2fa.telefon-de.com/

https://tse1.mm.bing.net/th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

150.171.27.10

Domains

Name

Malicious

2fa.telefon-de.com

46.137.49.168

Details

Name:	2fa.telefon-de.com
IP:	46.137.49.168
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
AI detected suspicious URL	Phishing	Browser Extensions
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

www.google.com

142.250.181.100

Details

Name:	www.google.com
IP:	142.250.181.100
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

ax-0001.ax-msedge.net

150.171.27.10

IPs

Domain

Country

Malicious

46.137.49.168

2fa.telefon-de.com

Ireland

192.168.2.8

unknown

192.168.2.6

unknown

142.250.181.100

www.google.com

United States

239.255.255.250

unknown

Reserved

54.154.95.205

unknown

United States

DOM / HTML

URL

Malicious

https://2fa.telefon-de.com/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://2fa.telefon-de.com

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://2fa.telefon-de.com

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
http://2fa.telefon-de.com