Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Korepi/Korepi.exe

windows10-2004-x64

10

Korepi/cef.js

windows10-2004-x64

1

Korepi/cef...ent.js

windows10-2004-x64

1

Korepi/cef...ent.js

windows10-2004-x64

1

Korepi/cef...ons.js

windows10-2004-x64

1

Korepi/chrome_elf.dll

windows10-2004-x64

3

Korepi/d3d...47.dll

windows10-2004-x64

3

Korepi/dev...ces.js

windows10-2004-x64

1

Korepi/dll...lf.dll

windows10-2004-x64

3

Korepi/dll...47.dll

windows10-2004-x64

3

Korepi/dll/libEGL.dll

windows10-2004-x64

1

Korepi/dll...v2.dll

windows10-2004-x64

3

Korepi/dll/libcef.dll

windows10-2004-x64

1

Korepi/ffmpeg.dll

windows10-2004-x64

1

Korepi/libEGL.dll

windows10-2004-x64

1

Korepi/libGLESv2.dll

windows10-2004-x64

3

Korepi/libcef.dll

windows10-2004-x64

1

Korepi/nat...lob.js

windows10-2004-x64

1

Korepi/vgrl.dll

windows10-2004-x64

1

Korepi/vivoxsdk.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    139s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/02/2024, 08:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Korepi/d3dcompiler_47.dll

  • Size

    3.5MB

  • MD5

    d2d0ff97605d2c2f8921e93062eb01ff

  • SHA1

    586cdca915f47fa4b1010f781ec0504e3138efd2

  • SHA256

    4056e0804a13d791362555636ba34158fade7c1e71599e415a285de1472d83d5

  • SHA512

    7bff38be4c5c41a978b33b9458dc885c59e68fa3dd4e56c6b980d334837bef37b2205b1b69aa1f058c0d8e24e3938c29da917a198b640b521d9726a505683b10

  • SSDEEP

    49152:KrqFNHA0sqBRTFXIgeElWEmsZbcjTmV8h6rc15K5mppbIar24SP1sEZgTK3iU7Ed:KrwNvDLICV8suT724SFSmsJ

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\d3dcompiler_47.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\d3dcompiler_47.dll,#1
      2⤵
        PID:3556
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 612
          3⤵
          • Program crash
          PID:4972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3556 -ip 3556
      1⤵
        PID:2916

      Network

      • flag-us
        DNS
        149.220.183.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        149.220.183.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        187.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        187.178.17.96.in-addr.arpa
        IN PTR
        Response
        187.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-187deploystaticakamaitechnologiescom
      • flag-us
        DNS
        73.31.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        73.31.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        104.219.191.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.219.191.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        58.55.71.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        58.55.71.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        97.17.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        97.17.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        26.165.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.165.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        15.164.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        15.164.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
        Response
        18.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-18deploystaticakamaitechnologiescom
      • flag-us
        DNS
        175.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        175.178.17.96.in-addr.arpa
        IN PTR
        Response
        175.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-175deploystaticakamaitechnologiescom
      • flag-us
        DNS
        14.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        14.227.111.52.in-addr.arpa
        IN PTR
        Response
      • 138.91.171.81:80
        52 B
         1
      • 8.8.8.8:53
        149.220.183.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        149.220.183.52.in-addr.arpa

      • 8.8.8.8:53
        187.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        187.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        73.31.126.40.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        73.31.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        104.219.191.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        104.219.191.52.in-addr.arpa

      • 8.8.8.8:53
        58.55.71.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        58.55.71.13.in-addr.arpa

      • 8.8.8.8:53
        97.17.167.52.in-addr.arpa
        dns
        71 B
         145 B
         1
        1

        DNS Request

        97.17.167.52.in-addr.arpa

      • 8.8.8.8:53
        26.165.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        26.165.165.52.in-addr.arpa

      • 8.8.8.8:53
        15.164.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        15.164.165.52.in-addr.arpa

      • 8.8.8.8:53
        18.134.221.88.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        18.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        175.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        175.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        14.227.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        14.227.111.52.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.