Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 44

HTML document, ASCII text, with CRLF line terminators

downloaded

Details

File:	Chrome Cache Entry: 44
Category:	downloaded
Dump:	chromecache_44.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with CRLF line terminators
Entropy:	4.660801881684815
Encrypted:	false
Ssdeep:	12:TvgsoCVIogs01lI5r8INGlTF5TF5TF5TF5TF5TFK:cEQtnDTPTPTPTPTPTc
Size:	548
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 45

HTML document, ASCII text, with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 45
Category:	downloaded
Dump:	chromecache_45.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with no line terminators
Entropy:	4.821833259337711
Encrypted:	false
Ssdeep:	6:fc3MRJVxr8MewLcLcyNAUm0RfMewLcLhCX9BXW31AXVVbpieiSLR/b:fc3MxxYMe+cLbpm0RfMe+cLUPXK+XVVD
Size:	255
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 46

ASCII text, with very long lines (8034), with no line terminators

dropped

Details

File:	Chrome Cache Entry: 46
Category:	dropped
Dump:	chromecache_46.2.dr
ID:	dr_2
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (8034), with no line terminators
Entropy:	5.747735986773892
Encrypted:	false
Ssdeep:	96:h6M/XWI5qRwwnT4C1hqt5LxCSg0wznlxoGJKUrXddSMdQ1EBUF9MUM+02:UgXWg7wEMqtRxCf0YDJtr7/m9Mf2
Size:	8034
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 47

ASCII text, with very long lines (8075), with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 47
Category:	downloaded
Dump:	chromecache_47.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (8075), with no line terminators
Entropy:	5.753206514499075
Encrypted:	false
Ssdeep:	192:ufqitWraDfdsLO/IcyrdpmlNyNOAIO8W2JgbceKGs0e:qdtWraDfdsCP5lNyNOQ2Kcea
Size:	8075
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 48

HTML document, ASCII text, with very long lines (1195), with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 48
Category:	downloaded
Dump:	chromecache_48.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (1195), with no line terminators
Entropy:	5.2233607453025375
Encrypted:	false
Ssdeep:	24:kTeRH8eVxvrCJjsuRpRFGLnxbFGWRVxKu1JJSa7oRW7aRWXCunouOvTMOKFId6Je:8eFj/e5dHGLrGWVSTw2wptI8Id6w
Size:	1195
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	4296
Target ID:	0
Parent PID:	5076
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	22:56:50
Date:	23/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2208,i,14211548071798225933,8504382171299703789,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2104
Target ID:	2
Parent PID:	4296
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2208,i,14211548071798225933,8504382171299703789,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	22:56:53
Date:	23/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.co/yXelyYqHRk"

Details

Is windows:	true
Is dropped:	false
PID:	6344
Target ID:	3
Parent PID:	5076
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.co/yXelyYqHRk"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	22:56:56
Date:	23/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://t.co/yXelyYqHRk

172.66.0.227

https://sleipmre.com/cdn-cgi/challenge-platform/h/g/jsd/r/8d76b26ff96b4662

172.67.150.161

https://a.nel.cloudflare.com/report/v4?s=c04IIx1Yv5z4PzzB%2Fr10iXdU%2BbbOMzE%2B9iMLdrGiGZxGoQbCMy1e2OonUnfopU%2BIugASJ0Q%2BTQdq1vzzPFpsFZRxGfQUaDnROJ3X8ovLAmPVB%2B4SrQJcXVG6Jx0UblY%3D

35.190.80.1

https://a.nel.cloudflare.com/report/v4?s=62fJnQrkwaELKRGDlOViyT%2BKow%2BR99c1M0bZs18%2BthDa%2BHG9AZx8WNz%2FnifcgaAYh5RPRY5cZ0CP5o%2FImXjIDlRtFewIi6VaxwmQZB3N7UdX0ph6KnC47DvcOahCgbA%3D

35.190.80.1

https://sleipmre.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

172.67.150.161

https://sleipmre.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?

172.67.150.161

https://sleipmre.com/sn/b10o.html

https://sleipmre.com/favicon.ico

172.67.150.161

https://a.nel.cloudflare.com/report/v4?s=RH66EzDQwUq3kht2Wf6ZqwHRarTCDRK9PkEzsvw7q5z3%2FT8Y8ZfqByFLN0OKQYzaKVI91uqrGhA5R4dVHpv0VLgBSx%2F8VHXkUL0r54%2FSOO3EgLpiFs2vei1diZjjrU8%3D

35.190.80.1

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.210.172

a.nel.cloudflare.com

35.190.80.1

Details

Name:	a.nel.cloudflare.com
IP:	35.190.80.1
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

t.co

172.66.0.227

Details

Name:	t.co
IP:	172.66.0.227
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

s-part-0036.t-0009.t-msedge.net

13.107.246.64

www.google.com

142.250.181.228

Details

Name:	www.google.com
IP:	142.250.181.228
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

sleipmre.com

172.67.150.161

Details

Name:	sleipmre.com
IP:	172.67.150.161
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

fp2e7a.wpc.phicdn.net

192.229.221.95

s-part-0032.t-0009.t-msedge.net

13.107.246.60

IPs

Domain

Country

Malicious

239.255.255.250

unknown

Reserved

142.250.181.228

www.google.com

United States

172.67.150.161

sleipmre.com

United States

192.168.2.16

unknown

35.190.80.1

a.nel.cloudflare.com

United States

192.168.2.4

unknown

172.66.0.227

t.co

United States

DOM / HTML

URL

Malicious

https://sleipmre.com/sn/b10o.html

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://t.co/yXelyYqHRk

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://t.co/yXelyYqHRk

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://t.co/yXelyYqHRk