Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 44

PNG image data, 306 x 90, 8-bit colormap, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 44
Category:	downloaded
Dump:	chromecache_44.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 306 x 90, 8-bit colormap, non-interlaced
Entropy:	7.891960792073307
Encrypted:	false
Ssdeep:	96:pVR8tAXdv46Nbd/o5AQ1MyzREs9wrTirdu:/RfvjNJQ5AJUEsVo
Size:	3754
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 45

PNG image data, 1200 x 429, 8-bit gray+alpha, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 45
Category:	downloaded
Dump:	chromecache_45.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 1200 x 429, 8-bit gray+alpha, non-interlaced
Entropy:	7.908318253066291
Encrypted:	false
Ssdeep:	768:YNnRMpVJAjORfNX6rGuNUOrXihepmJ85T6sF4/WJX2F:YNaVOjqf56TkesMrF4/v
Size:	31492
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 46

assembler source, ASCII text, with very long lines (492)

downloaded

Details

File:	Chrome Cache Entry: 46
Category:	downloaded
Dump:	chromecache_46.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	assembler source, ASCII text, with very long lines (492)
Entropy:	4.890373376889972
Encrypted:	false
Ssdeep:	192:X+oZVfKQh8kRvXOd8O/6+rpoaDxpWdt+6SEL8:X+pLkR2dy+rpocUW
Size:	7049
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 47

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 47
Category:	downloaded
Dump:	chromecache_47.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	4.829990999503574
Encrypted:	false
Ssdeep:	48:7EoSzpkLRJGZkGbyaH7UU6mGe7Df/wcwT7TlNiCr49NpCsdzplpZXXdHBdHZbXBd:7KyPGbntnCXloBY0DC1CPcA5Qqjb
Size:	5141
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 48

PNG image data, 306 x 90, 8-bit colormap, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 48
Category:	dropped
Dump:	chromecache_48.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 306 x 90, 8-bit colormap, non-interlaced
Entropy:	7.891960792073307
Encrypted:	false
Ssdeep:	96:pVR8tAXdv46Nbd/o5AQ1MyzREs9wrTirdu:/RfvjNJQ5AJUEsVo
Size:	3754
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 49

PNG image data, 1200 x 429, 8-bit gray+alpha, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 49
Category:	dropped
Dump:	chromecache_49.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 1200 x 429, 8-bit gray+alpha, non-interlaced
Entropy:	7.908318253066291
Encrypted:	false
Ssdeep:	768:YNnRMpVJAjORfNX6rGuNUOrXihepmJ85T6sF4/WJX2F:YNaVOjqf56TkesMrF4/v
Size:	31492
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	2132
Target ID:	0
Parent PID:	5764
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	15:38:43
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2420,i,13220806112028652850,5594722088436190633,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	984
Target ID:	2
Parent PID:	2132
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2420,i,13220806112028652850,5594722088436190633,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	15:38:45
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://cyathe.github.io/IG"

Details

Is windows:	true
Is dropped:	false
PID:	6316
Target ID:	3
Parent PID:	5764
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://cyathe.github.io/IG"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	15:38:48
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://cyathe.github.io/IG

185.199.109.153

https://play.google.com/store/apps/details?id=com.instagram.android&referrer=utm_source%3Dinstag

unknown

https://upload.wikimedia.org/wikipedia/commons/thumb/2/2a/Instagram_logo.svg/1200px-Instagram_logo.s

unknown

https://cyathe.github.io/IG

185.199.109.153

https://cyathe.github.io/IG/css.css

185.199.109.153

https://www.instagram.com/accounts/password/reset

unknown

https://about.instagram.com

unknown

https://help.instagram.com/581066165581870

unknown

https://www.instagram.com/directory/hashtags

unknown

https://www.instagram.com/p/C0PcHE5OMfs/?img_index=1

unknown

https://www.instagram.com/static/images/appstore-install-badges/badge_ios_english-en.png/4b70f6fae447.png

157.240.252.174

https://about.instagram.com/about-us/careers

unknown

https://discord.com/api/webhooks/1200369328663576616/7yZW-8oF0g6D3oSvwjvTKeR5Qq0nTt_B6lXxE1IjI_Y4gfZ

unknown

https://upload.wikimedia.org/wikipedia/commons/thumb/2/2a/Instagram_logo.svg/1200px-Instagram_logo.svg.png

185.15.59.240

https://www.instagram.com/static/images/appstore-install-badges/badge_android_english-en.png/f06b908

unknown

https://help.instagram.com/519522125107875

unknown

https://cyathe.github.io/IG/

185.199.109.153

https://www.instagram.com/static/images/appstore-install-badges/badge_ios_english-en.png/4b70f6fae44

unknown

https://www.instagram.com/accounts/emailsignup

unknown

https://about.instagram.com/blog

unknown

https://help.instagram.com

unknown

https://www.instagram.com/developer

unknown

There are 12 hidden URLs, click here to show them.

Domains

Name

Malicious

cyathe.github.io

185.199.109.153

Details

Name:	cyathe.github.io
IP:	185.199.109.153
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

s-part-0017.t-0009.t-msedge.net

13.107.246.45

www.google.com

142.250.184.196

Details

Name:	www.google.com
IP:	142.250.184.196
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

upload.wikimedia.org

185.15.59.240

Details

Name:	upload.wikimedia.org
IP:	185.15.59.240
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

z-p42-instagram.c10r.instagram.com

157.240.252.174

s-part-0032.t-0009.t-msedge.net

13.107.246.60

www.instagram.com

unknown

Details

Name:	www.instagram.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

142.250.184.196

www.google.com

United States

185.199.109.153

cyathe.github.io

Netherlands

192.168.2.4

unknown

157.240.252.174

z-p42-instagram.c10r.instagram.com

United States

192.168.2.5

unknown

239.255.255.250

unknown

Reserved

185.15.59.240

upload.wikimedia.org

Netherlands

192.168.2.23

unknown

157.240.0.174

unknown

United States

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://cyathe.github.io/IG

Files

Processes

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://cyathe.github.io/IG

Files

Processes

URLs

Domains

IPs

IOC Report
http://cyathe.github.io/IG