Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 61

ASCII text, with very long lines (2294)

downloaded

Details

File:	Chrome Cache Entry: 61
Category:	downloaded
Dump:	chromecache_61.3.dr
ID:	dr_8
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (2294)
Entropy:	5.544045381504343
Encrypted:	false
Ssdeep:	3072:CMiFOP4roKgkk/EFZMQbxjZW1BKo6JMI6l0nt8Uv1ziwtXOmDsY+WwYLF/HrY7+A:CMiroKfbMQbxjZW1BKo6JMI6l0nt8Uvq
Size:	163286
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 62

ASCII text, with very long lines (6841)

downloaded

Details

File:	Chrome Cache Entry: 62
Category:	downloaded
Dump:	chromecache_62.3.dr
ID:	dr_9
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (6841)
Entropy:	5.798051837404007
Encrypted:	false
Ssdeep:	192:R6H6666Y2bVtYU+U1kSmdN6666V73S322oC/9E:R6H6666NtYUf5o6666p3SmM2
Size:	6846
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 63

ASCII text

downloaded

Details

File:	Chrome Cache Entry: 63
Category:	downloaded
Dump:	chromecache_63.3.dr
ID:	dr_10
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text
Entropy:	3.9353986674667634
Encrypted:	false
Ssdeep:	3:VQAOx/1n:VQAOd1n
Size:	29
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 64

ASCII text, with very long lines (3572), with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 64
Category:	downloaded
Dump:	chromecache_64.3.dr
ID:	dr_11
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (3572), with no line terminators
Entropy:	5.140651484312947
Encrypted:	false
Ssdeep:	48:vZUJVKLICJEconBdpZUvGCUvGULHg7OTehn5hsbrc7g8IO8u0Y8D2n:yJYI/coXqCg7OSfg8IO8uB8D2n
Size:	3572
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 65

ASCII text, with very long lines (65531)

downloaded

Details

File:	Chrome Cache Entry: 65
Category:	downloaded
Dump:	chromecache_65.3.dr
ID:	dr_12
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (65531)
Entropy:	5.4411107500040945
Encrypted:	false
Ssdeep:	1536:jdGuEyWn2zuFRDP6nWysx3DMqPKnrzNSpGiV1p+RHPGb4gujNP8jZRLM9rZxMkPr:Dsnoap3DTKnrQpG4nQUduO6ZxMkmwXd
Size:	137078
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 66

HTML document, ASCII text, with CRLF line terminators

downloaded

Details

File:	Chrome Cache Entry: 66
Category:	downloaded
Dump:	chromecache_66.3.dr
ID:	dr_13
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with CRLF line terminators
Entropy:	4.688532577858027
Encrypted:	false
Ssdeep:	12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
Size:	548
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 67

SVG Scalable Vector Graphics image

downloaded

Details

File:	Chrome Cache Entry: 67
Category:	downloaded
Dump:	chromecache_67.3.dr
ID:	dr_14
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	SVG Scalable Vector Graphics image
Entropy:	4.301517070642596
Encrypted:	false
Ssdeep:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
Size:	1660
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 68

ASCII text, with very long lines (2124)

downloaded

Details

File:	Chrome Cache Entry: 68
Category:	downloaded
Dump:	chromecache_68.3.dr
ID:	dr_15
Target ID:	3
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (2124)
Entropy:	5.506662476672723
Encrypted:	false
Ssdeep:	3072:QI9yvwslCsrCF9f/U2Dj3Fkk7rEehA5L1kx:l9ygsrieDkVaL1kx
Size:	121628
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	2844
Target ID:	0
Parent PID:	3196
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	05:32:14
Date:	06/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///

Details

Is windows:	true
Is dropped:	false
PID:	4144
Target ID:	1
Parent PID:	5328
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	05:32:19
Date:	06/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2000,i,17449975914517360887,1340231660079692741,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2700
Target ID:	3
Parent PID:	2844
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2000,i,17449975914517360887,1340231660079692741,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	05:32:20
Date:	06/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=964,i,7821398057109531615,15787434121257409365,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6480
Target ID:	4
Parent PID:	4144
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=964,i,7821398057109531615,15787434121257409365,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	05:32:21
Date:	06/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://apidevst.com"

Details

Is windows:	true
Is dropped:	false
PID:	1928
Target ID:	9
Parent PID:	3196
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://apidevst.com"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	05:32:47
Date:	06/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://apidevst.com

https://apidevst.com/favicon.ico

193.124.22.107

http://apidevst.com/

193.124.22.107

https://play.google.com/log?format=json&hasfast=true

unknown

https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw

172.217.165.196

https://apidevst.com/

http://www.broofa.com

unknown

https://csp.withgoogle.com/csp/lcreport/

unknown

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0

142.250.64.206

https://www.google.com/async/newtab_promos

172.217.165.196

https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

172.217.165.196

https://apis.google.com

unknown

https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1

unknown

https://domains.google.com/suggest/flow

unknown

https://clients6.google.com

unknown

https://plus.google.com

unknown

There are 5 hidden URLs, click here to show them.

Domains

Name

Malicious

apidevst.com

193.124.22.107

Details

Name:	apidevst.com
IP:	193.124.22.107
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

plus.l.google.com

142.250.64.206

www.google.com

172.217.165.196

Details

Name:	www.google.com
IP:	172.217.165.196
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

apis.google.com

unknown

Details

Name:	apis.google.com
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

193.124.22.107

apidevst.com

Russian Federation

Details

IP:	193.124.22.107
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	Russian Federation
Countrycode:	RUS
ASN number:	20853
ASN name:	ETOP-ASPL
Private:	false
Domain:	apidevst.com

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking

192.168.2.4

unknown

239.255.255.250

unknown

Reserved

142.250.64.206

plus.l.google.com

United States

172.217.165.196

www.google.com

United States

DOM / HTML

URL

Malicious

https://apidevst.com/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://apidevst.com

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://apidevst.com

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
http://apidevst.com