4daaba19d412cdf3838a0c373cdc9b7cfc26423723307482e4b0f946909c726e | Triage

Analysis

max time kernel
139s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2023, 00:41 UTC

Sharing

Report Analysis Logs

General

Target

OBS/Configuration/About/cs-CZ/fms.dll
Size

14KB
MD5

6c9ef9be12d3dff8516a977039d38f42
SHA1

350c29c78f13f112448f00a0773a4357d20da632
SHA256

d900b2ee80feec5175d004a3426deebdc66fedb352006f673d257f23521c6636
SHA512

f8e7f5f8e0855d43b090d959d3c558d2a5e316cf883033bb81ec8ed7738be2368ae5d38bc56a9045373ab7072d840bf417eff2274eab3a662a5da721021ef482
SSDEEP

384:mrJ9xN7zIy001KnWj9ztiGikifwxMpV+gWKK:8xyK

Score

1^/10

Malware Config

Signatures

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OBS\Configuration\About\cs-CZ\fms.dll,#1
1⤵
PID:4724

Network

DNS

176.122.125.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

176.122.125.40.in-addr.arpa

IN PTR

Response
DNS

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

Remote address:

8.8.8.8:53

Request

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

IN PTR

Response

93.184.220.29:80

322 B
7
104.80.225.205:443

322 B
7
20.42.73.26:443

322 B
7

8.8.8.8:53

176.122.125.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

176.122.125.40.in-addr.arpa
8.8.8.8:53

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

dns

118 B
204 B
1
1

DNS Request

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads