Analysis

  • max time kernel
    130s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2023, 14:25 UTC

General

  • Target

    Hornynite-0.14-Windows.zip

  • Size

    141.8MB

  • MD5

    5e515078794381b50b169b71441337a7

  • SHA1

    76a1e8237ccd4c02a8f39def26762fae56cc7b92

  • SHA256

    42d3445f936aa637139d15f6a2238a5d53b145d5938255daad1b81fd2a1aa153

  • SHA512

    cd81d582e5c04f1fed880d1569dfcad87fb4fd13b75abe768256b46dfea7dbb7db53dc7b0f60c91472461b6919c6a17747796e9833be6ed404f4f659525afd3c

  • SSDEEP

    3145728:EfaPtaLZh+7HZnV4jytm8fD0CAv33GPSk/TpNbMsoUzjKs:RPg9h+7HxiR33OlpvTnKs

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Hornynite-0.14-Windows.zip
    1⤵
      PID:548

    Network

    • flag-us
      DNS
      2.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      126.209.247.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      126.209.247.8.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.165.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.165.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      133.121.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.121.18.2.in-addr.arpa
      IN PTR
      Response
      133.121.18.2.in-addr.arpa
      IN PTR
      a2-18-121-133deploystaticakamaitechnologiescom
    • flag-us
      DNS
      19.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      1.202.248.87.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.202.248.87.in-addr.arpa
      IN PTR
      Response
      1.202.248.87.in-addr.arpa
      IN PTR
      https-87-248-202-1amsllnwnet
    • flag-us
      DNS
      131.109.69.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      131.109.69.13.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      2.159.190.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      2.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      126.209.247.8.in-addr.arpa
      dns
      72 B
      126 B
      1
      1

      DNS Request

      126.209.247.8.in-addr.arpa

    • 8.8.8.8:53
      26.165.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      26.165.165.52.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      133.121.18.2.in-addr.arpa
      dns
      71 B
      135 B
      1
      1

      DNS Request

      133.121.18.2.in-addr.arpa

    • 8.8.8.8:53
      19.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      19.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      1.202.248.87.in-addr.arpa
      dns
      71 B
      116 B
      1
      1

      DNS Request

      1.202.248.87.in-addr.arpa

    • 8.8.8.8:53
      131.109.69.13.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      131.109.69.13.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.