Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
23/05/2023, 19:37 UTC
General
-
Target
d0ef1758a4936f49795bf965c265b98fe9a95397907c1159d0ffa4463c4e61f2.exe
-
Size
2.8MB
-
MD5
9b9cf8f50964d0000e3c683fa128ed42
-
SHA1
5cd4abe44e6334a4dd267fd63ce24d8c5cf1268e
-
SHA256
d0ef1758a4936f49795bf965c265b98fe9a95397907c1159d0ffa4463c4e61f2
-
SHA512
b8017ddfc85492b9c802355b8b55828472569a327a84fbd03133b77c055aea36d97f8a65bc2806d67a7cb286e5f90b289f7bd77902302c95764181c1229e5c36
-
SSDEEP
49152:l7RWTNZl70y+595irywIsWAEc2D+DbnYwTeW:tRWT970y+5HirQsWAkD+DEfW
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0ef1758a4936f49795bf965c265b98fe9a95397907c1159d0ffa4463c4e61f2.exe"C:\Users\Admin\AppData\Local\Temp\d0ef1758a4936f49795bf965c265b98fe9a95397907c1159d0ffa4463c4e61f2.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
-
DNS96.108.152.52.in-addr.arpaRemote address:8.8.8.8:53Request96.108.152.52.in-addr.arpaIN PTRResponse -
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
DNS133.211.185.52.in-addr.arpaRemote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
DNS86.8.109.52.in-addr.arpaRemote address:8.8.8.8:53Request86.8.109.52.in-addr.arpaIN PTRResponse
-
13.69.239.74:443 -
8.238.179.126:80 -
8.238.179.126:80
-
173.223.113.164:443
-
8.8.8.8:5396.108.152.52.in-addr.arpadns
DNS Request
96.108.152.52.in-addr.arpa
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
-
8.8.8.8:53133.211.185.52.in-addr.arpadns
DNS Request
133.211.185.52.in-addr.arpa
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:5386.8.109.52.in-addr.arpadns
DNS Request
86.8.109.52.in-addr.arpa