Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 46

PNG image data, 535 x 220, 8-bit/color RGBA, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 46
Category:	dropped
Dump:	chromecache_46.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 535 x 220, 8-bit/color RGBA, non-interlaced
Entropy:	7.9401440913208265
Encrypted:	false
Ssdeep:	192:fRWOsB4/9rEZYlseoG2nE1ND8w8U3mGl5Xf1fqJL3V5+06tskn3RzkU042IC2JW5:f9ZEZYSGXowd3mQVqJLF6+kW7z/anc
Size:	12949
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 47

ASCII text

downloaded

Details

File:	Chrome Cache Entry: 47
Category:	downloaded
Dump:	chromecache_47.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text
Entropy:	4.841010868698641
Encrypted:	false
Ssdeep:	192:I1RYMV2pFifOiWvtWR4xSxZxkKwqjG8dxfU0g16CSI+ibalwfTcuuv:SRYzn2Ksnwn16CLuv
Size:	7717
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 48

PNG image data, 535 x 220, 8-bit/color RGBA, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 48
Category:	downloaded
Dump:	chromecache_48.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 535 x 220, 8-bit/color RGBA, non-interlaced
Entropy:	7.9401440913208265
Encrypted:	false
Ssdeep:	192:fRWOsB4/9rEZYlseoG2nE1ND8w8U3mGl5Xf1fqJL3V5+06tskn3RzkU042IC2JW5:f9ZEZYSGXowd3mQVqJLF6+kW7z/anc
Size:	12949
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 49

ASCII text, with very long lines (65371)

downloaded

Details

File:	Chrome Cache Entry: 49
Category:	downloaded
Dump:	chromecache_49.2.dr
ID:	dr_11
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (65371)
Entropy:	5.0982146191887106
Encrypted:	false
Ssdeep:	768:Vy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1FS:nw/a1fIuiHlq5mN8lDbNmPbh
Size:	121200
Whitelisted:	true
Reputation:	low

Chrome Cache Entry: 50

ASCII text, with very long lines (32065)

downloaded

Details

File:	Chrome Cache Entry: 50
Category:	downloaded
Dump:	chromecache_50.2.dr
ID:	dr_12
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (32065)
Entropy:	5.366055229017455
Encrypted:	false
Ssdeep:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
Size:	85578
Whitelisted:	true
Reputation:	low

Chrome Cache Entry: 51

GIF image data, version 89a, 670 x 820

downloaded

Details

File:	Chrome Cache Entry: 51
Category:	downloaded
Dump:	chromecache_51.2.dr
ID:	dr_13
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	GIF image data, version 89a, 670 x 820
Entropy:	7.942309322694616
Encrypted:	false
Ssdeep:	768:bgT093APCXBs6xRlwSGReJsk68+6Xminl4nDTnYYw/TZ8jkx:8o3uaRCSGQ68zqDzBw/TZ8jkx
Size:	31339
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 52

GIF image data, version 89a, 670 x 820

dropped

Details

File:	Chrome Cache Entry: 52
Category:	dropped
Dump:	chromecache_52.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	GIF image data, version 89a, 670 x 820
Entropy:	7.942309322694616
Encrypted:	false
Ssdeep:	768:bgT093APCXBs6xRlwSGReJsk68+6Xminl4nDTnYYw/TZ8jkx:8o3uaRCSGQ68zqDzBw/TZ8jkx
Size:	31339
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 53

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 53
Category:	downloaded
Dump:	chromecache_53.2.dr
ID:	dr_14
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	4.8910304964985825
Encrypted:	false
Ssdeep:	24:hYFUFCBeblKwNV4N6ZNzVQ1jwZAMRppE9IdcWfz/zVd1i:gEK9NitVQ1w+MRppE9ccWffVS
Size:	1111
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 54

ASCII text, with very long lines (32065)

dropped

Details

File:	Chrome Cache Entry: 54
Category:	dropped
Dump:	chromecache_54.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (32065)
Entropy:	5.366055229017455
Encrypted:	false
Ssdeep:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
Size:	85578
Whitelisted:	true
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	5572
Target ID:	0
Parent PID:	4484
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:23:40
Date:	25/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1964,i,1011053822055246351,4298913378853297238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2008
Target ID:	2
Parent PID:	5572
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1964,i,1011053822055246351,4298913378853297238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:23:43
Date:	25/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://offer.relieffoot.com"

Details

Is windows:	true
Is dropped:	false
PID:	6348
Target ID:	3
Parent PID:	4484
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://offer.relieffoot.com"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:23:45
Date:	25/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://offer.relieffoot.com

https://github.com/twbs/bootstrap/blob/master/LICENSE)

unknown

http://offer.relieffoot.com/

47.254.37.3

https://offer.relieffoot.com/favicon.ico

47.254.37.3

https://offer.relieffoot.com/img/500.png

47.254.37.3

https://offer.relieffoot.com/libs/jquery/jquery.min.js

47.254.37.3

https://offer.relieffoot.com/libs/bootstrap/bootstrap.min.css

47.254.37.3

https://offer.relieffoot.com/

http://getbootstrap.com)

unknown

https://offer.relieffoot.com/libs/theme/pblog/css/web-common.css

47.254.37.3

Domains

Name

Malicious

offer.relieffoot.com

47.254.37.3

Details

Name:	offer.relieffoot.com
IP:	47.254.37.3
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

www.google.com

142.250.181.68

Details

Name:	www.google.com
IP:	142.250.181.68
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

239.255.255.250

unknown

Reserved

47.254.37.3

offer.relieffoot.com

United States

142.250.181.68

www.google.com

United States

192.168.2.4

unknown

DOM / HTML

URL

Malicious

https://offer.relieffoot.com/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://offer.relieffoot.com

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://offer.relieffoot.com

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
http://offer.relieffoot.com