Overview

overview

7

Static

static

3

Hexa v1.5.zip

windows7-x64

1

Hexa v1.5.zip

windows10-2004-x64

1

Hexa v1.5/...de.dll

windows7-x64

1

Hexa v1.5/...de.dll

windows10-2004-x64

1

Hexa v1.5/...er.dll

windows7-x64

1

Hexa v1.5/...er.dll

windows10-2004-x64

1

Hexa v1.5/...ts.dll

windows7-x64

1

Hexa v1.5/...ts.dll

windows10-2004-x64

1

Hexa v1.5/...er.dll

windows7-x64

1

Hexa v1.5/...er.dll

windows10-2004-x64

1

Hexa v1.5/...de.dll

windows7-x64

1

Hexa v1.5/...de.dll

windows10-2004-x64

1

Hexa v1.5/...data_0

windows7-x64

1

Hexa v1.5/...data_0

windows10-2004-x64

1

Hexa v1.5/...data_1

windows7-x64

1

Hexa v1.5/...data_1

windows10-2004-x64

1

Hexa v1.5/...data_2

windows7-x64

1

Hexa v1.5/...data_2

windows10-2004-x64

1

Hexa v1.5/...data_3

windows7-x64

1

Hexa v1.5/...data_3

windows10-2004-x64

1

Hexa v1.5/.../index

windows7-x64

1

Hexa v1.5/.../index

windows10-2004-x64

1

Hexa v1.5/...er.exe

windows7-x64

7

Hexa v1.5/...er.exe

windows10-2004-x64

7

Hexa v1.5/...config

windows7-x64

3

Hexa v1.5/...config

windows10-2004-x64

3

Hexa v1.5/...al.dll

windows7-x64

1

Hexa v1.5/...al.dll

windows10-2004-x64

3

Hexa v1.5/...or.dll

windows7-x64

1

Hexa v1.5/...or.dll

windows10-2004-x64

1

Hexa v1.5/...HT.txt

windows7-x64

1

Hexa v1.5/...HT.txt

windows10-2004-x64

1

Resubmissions

23/04/2023, 17:07 UTC

230423-vm2waagc9v 7

23/04/2023, 17:03 UTC

230423-vkr83aeg34 7

23/04/2023, 16:56 UTC

230423-vf3h8sef88 7

Analysis

  • max time kernel
    98s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 16:56 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Hexa v1.5/Hexa/Community/Scripts/ScriptMaker.dll

  • Size

    111B

  • MD5

    07dcc6ab899f8bab6294f402f0e8050b

  • SHA1

    8aed7860954031f41561c29f33eaf57dcaf6f0f0

  • SHA256

    6b9f598b3f655cc079c4534e65aa097209cafa6b158e766f1ab654be4cf13a9b

  • SHA512

    4b8e19676cb4e300d40a5a83d7cf1fa034e78ab01230bf78d70dc9d4408d0c0578b98bf73ab3ad5d2ffb1b142609ae83fa96164fca92def4b52ad4274975c42c

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Hexa v1.5\Hexa\Community\Scripts\ScriptMaker.dll",#1
    1⤵
      PID:3384

    Network

    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      254.131.241.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      254.131.241.8.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      0.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      76.38.195.152.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      76.38.195.152.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      73.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      123.108.74.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      123.108.74.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      62.13.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      62.13.109.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.165.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.165.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      2.36.159.162.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.36.159.162.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      86.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.23.85.13.in-addr.arpa
      IN PTR
      Response
    • 93.184.221.240:80
      322 B
       7
    • 40.79.141.154:443
      322 B
       7
    • 52.152.108.96:443
      260 B
       5
    • 93.184.221.240:80
      322 B
       7
    • 93.184.221.240:80
      322 B
       7
    • 173.223.113.164:443
      322 B
       7
    • 173.223.113.131:80
      322 B
       7
    • 204.79.197.203:80
      322 B
       7
    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      254.131.241.8.in-addr.arpa
      dns
      72 B
       126 B
       1
      1

      DNS Request

      254.131.241.8.in-addr.arpa

    • 8.8.8.8:53
      0.159.190.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      0.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      76.38.195.152.in-addr.arpa
      dns
      72 B
       143 B
       1
      1

      DNS Request

      76.38.195.152.in-addr.arpa

    • 8.8.8.8:53
      73.159.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      73.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      123.108.74.40.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      123.108.74.40.in-addr.arpa

    • 8.8.8.8:53
      62.13.109.52.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      62.13.109.52.in-addr.arpa

    • 8.8.8.8:53
      26.165.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      26.165.165.52.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      2.36.159.162.in-addr.arpa
      dns
      71 B
       133 B
       1
      1

      DNS Request

      2.36.159.162.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      86.23.85.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      86.23.85.13.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.