Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2023, 12:08 UTC

General

  • Target

    Codaxy.Xlio.dll

  • Size

    188KB

  • MD5

    0c0d51860a34530cb8cf157f3c60c3f5

  • SHA1

    4fd25f31285025df7dfa861133f044dece413fd1

  • SHA256

    17e5a5514cca8a474ffa66e8a4e3d010c6cba4819a99a245fde04d8b6e001195

  • SHA512

    b63e35bb6ce33c465e845c14e384d3ad1c9329b94fb2405c1d0d08a8d3c2d6b7273c3e12123db7f231d8a43b21e5c38113be1dd4043894695051b498092ba200

  • SSDEEP

    3072:Ugf8v86t7KG3FYl0pDkqrcBjjHakBbnhZS+wEcPLDXpkWCiCtdzhV6GeHq81:Ugf8v86tuG3FiIgqrclnnhZS+HcTDXGF

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Codaxy.Xlio.dll,#1
    1⤵
      PID:5000

    Network

    • flag-us
      DNS
      134.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      134.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      54.120.234.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      54.120.234.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      164.113.223.173.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      164.113.223.173.in-addr.arpa
      IN PTR
      Response
      164.113.223.173.in-addr.arpa
      IN PTR
      a173-223-113-164deploystaticakamaitechnologiescom
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      103.169.127.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      103.169.127.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      1.202.248.87.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.202.248.87.in-addr.arpa
      IN PTR
      Response
      1.202.248.87.in-addr.arpa
      IN PTR
      https-87-248-202-1amsllnwnet
    • flag-us
      DNS
      1.208.79.178.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.208.79.178.in-addr.arpa
      IN PTR
      Response
      1.208.79.178.in-addr.arpa
      IN PTR
      https-178-79-208-1amsllnwnet
    • flag-us
      DNS
      1.77.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.77.109.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      211.143.182.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      211.143.182.52.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      134.32.126.40.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      134.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      54.120.234.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      54.120.234.20.in-addr.arpa

    • 8.8.8.8:53
      9.228.82.20.in-addr.arpa
      dns
      70 B
      156 B
      1
      1

      DNS Request

      9.228.82.20.in-addr.arpa

    • 8.8.8.8:53
      164.113.223.173.in-addr.arpa
      dns
      74 B
      141 B
      1
      1

      DNS Request

      164.113.223.173.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      103.169.127.40.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      103.169.127.40.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      1.202.248.87.in-addr.arpa
      dns
      71 B
      116 B
      1
      1

      DNS Request

      1.202.248.87.in-addr.arpa

    • 8.8.8.8:53
      1.208.79.178.in-addr.arpa
      dns
      71 B
      116 B
      1
      1

      DNS Request

      1.208.79.178.in-addr.arpa

    • 8.8.8.8:53
      1.77.109.52.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      1.77.109.52.in-addr.arpa

    • 8.8.8.8:53
      211.143.182.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      211.143.182.52.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.