IOC Report
https://lumen.backerkit.com/invites/mAqpu6B5ZtIAsrg4a5WdGA/confirm?redirect_path=//rahul-garg-lcatterton-com.athuselevadores.com.br

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 14:50:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 14:50:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 14:50:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 14:50:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 14:50:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
Unicode text, UTF-16, little-endian text, with CRLF line terminators
modified
Chrome Cache Entry: 67
HTML document, Unicode text, UTF-8 text, with very long lines (3121), with CRLF, LF line terminators
downloaded
Chrome Cache Entry: 68
Web Open Font Format (Version 2), TrueType, length 116672, version 773.256
downloaded
Chrome Cache Entry: 69
HTML document, ASCII text, with CRLF line terminators
dropped
Chrome Cache Entry: 70
ASCII text, with very long lines (47531)
downloaded
Chrome Cache Entry: 71
ASCII text, with very long lines (47531)
dropped
Chrome Cache Entry: 72
ASCII text, with very long lines (47992), with no line terminators
dropped
Chrome Cache Entry: 73
PNG image data, 16 x 43, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 74
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 75
JSON data
downloaded
Chrome Cache Entry: 76
PNG image data, 16 x 43, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 77
data
downloaded
Chrome Cache Entry: 78
Web Open Font Format (Version 2), TrueType, length 156532, version 773.256
downloaded
Chrome Cache Entry: 79
ASCII text, with very long lines (47992), with no line terminators
downloaded
Chrome Cache Entry: 80
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
dropped
There are 12 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1988,i,5379668934890043754,15086957964497128916,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lumen.backerkit.com/invites/mAqpu6B5ZtIAsrg4a5WdGA/confirm?redirect_path=//rahul-garg-lcatterton-com.athuselevadores.com.br"
C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://lumen.backerkit.com/invites/mAqpu6B5ZtIAsrg4a5WdGA/confirm?redirect_path=//rahul-garg-lcatterton-com.athuselevadores.com.br
malicious
https://ax3si7hub1rr.objectstorage.ap-singapore-2.oci.customer-oci.com/favicon.ico
217.142.168.1
https://cdn.jsdelivr.net/npm/bootstrap
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/602828571:1730216247:hU1JVbyKijtdUyJpcPx_11H0qSWFqnmCkoLtpOk75jI/8da452d5f8116bbc/Y4JbOerefBrl_xn27RO.r1PJgKAyhh88MgRHz4pkaHg-1730217050-1.1.1.1-hZ4u92QJ8.qahDCTU7tcTZODizOTEhVvtOWCRf7Vi9oLDra6izqze2UIynKjFRXc
104.18.95.41
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8da452d5f8116bbc/1730217053320/7BL7LlnT3QR8G8z
104.18.95.41
https://challenges.cloudflare.com/turnstile/v0/api.js
104.18.94.41
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/s78r3/0x4AAAAAAAhNeI7hVTjvzoX5/auto/fbE/normal/auto/
104.18.95.41
https://axelkirchhoffh.ru//#inventory
unknown
https://axelkirchhoffh.ru//#contact
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8da452d5f8116bbc&lang=auto
104.18.95.41
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8da452d5f8116bbc/1730217053319/3a7453e024aa7751b589715d75a71c9ff23b8f410ff13e8e84dec337084828f4/8EZUA_4eRzju1Q0
104.18.95.41
https://x.com/axelkirchhoffh.ru
unknown
https://ax3si7hub1rr.objectstorage.ap-singapore-2.oci.customer-oci.com/n/ax3si7hub1rr/b/bucket-20241028-2012/o/index.html#9rahul@garg.lcatterton.com
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-brands-400.woff2
104.17.24.14
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-solid-900.woff2
104.17.24.14
https://lumen.backerkit.com/invites/mAqpu6B5ZtIAsrg4a5WdGA/confirm?redirect_path=//rahul-garg-lcatterton-com.athuselevadores.com.br
172.67.7.211
https://axelkirchhoffh.ru//#services
unknown
https://instagram.com/axelkirchhoffh.ru
unknown
https://linkedin.com/in/axelkirchhoffh.ru
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
104.18.95.41
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css
unknown
https://ax3si7hub1rr.objectstorage.ap-singapore-2.oci.customer-oci.com/n/ax3si7hub1rr/b/bucket-20241028-2012/o/index.html
217.142.168.1
https://axelkirchhoffh.ru//
188.114.97.3
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
104.17.25.14
https://challenges.cloudflare.com/turnstile/v0/g/f2bbd6738e15/api.js
104.18.94.41
https://rahul-garg-lcatterton-com.athuselevadores.com.br/
107.161.183.172
There are 15 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
lumen.backerkit.com
172.67.7.211
 malicious
jsdelivr.map.fastly.net
151.101.129.229
ax3si7hub1rr.objectstorage.ap-singapore-2.oci.customer-oci.com
217.142.168.1
cdnjs.cloudflare.com
104.17.25.14
challenges.cloudflare.com
104.18.94.41
www.google.com
172.217.16.132
rahul-garg-lcatterton-com.athuselevadores.com.br
107.161.183.172
axelkirchhoffh.ru
188.114.97.3
cdn.jsdelivr.net
unknown
171.39.242.20.in-addr.arpa
unknown

IPs

IP
Domain
Country
Malicious
172.67.7.211
lumen.backerkit.com
United States
malicious
104.17.24.14
unknown
United States
217.142.168.1
ax3si7hub1rr.objectstorage.ap-singapore-2.oci.customer-oci.com
Sweden
151.101.129.229
jsdelivr.map.fastly.net
United States
104.18.94.41
challenges.cloudflare.com
United States
192.168.2.16
unknown
unknown
104.18.95.41
unknown
United States
142.250.185.100
unknown
United States
107.161.183.172
rahul-garg-lcatterton-com.athuselevadores.com.br
United States
239.255.255.250
unknown
Reserved
188.114.97.3
axelkirchhoffh.ru
European Union
192.168.2.14
unknown
unknown
188.114.96.3
unknown
European Union
172.217.16.132
www.google.com
United States
104.17.25.14
cdnjs.cloudflare.com
United States
There are 5 hidden IPs, click here to show them.

DOM / HTML

URL
Malicious
https://ax3si7hub1rr.objectstorage.ap-singapore-2.oci.customer-oci.com/n/ax3si7hub1rr/b/bucket-20241028-2012/o/index.html#9rahul@garg.lcatterton.com
 malicious
https://ax3si7hub1rr.objectstorage.ap-singapore-2.oci.customer-oci.com/n/ax3si7hub1rr/b/bucket-20241028-2012/o/index.html#9rahul@garg.lcatterton.com
 malicious
https://ax3si7hub1rr.objectstorage.ap-singapore-2.oci.customer-oci.com/n/ax3si7hub1rr/b/bucket-20241028-2012/o/index.html#9rahul@garg.lcatterton.com