Overview

overview

10

Static

static

10

Global Pro...n.html

windows7-x64

1

Global Pro...n.html

windows10-2004-x64

1

Global Pro...n.html

windows7-x64

1

Global Pro...n.html

windows10-2004-x64

1

Global Pro...n.html

windows7-x64

1

Global Pro...n.html

windows10-2004-x64

1

Global Pro...el.exe

windows7-x64

1

Global Pro...el.exe

windows10-2004-x64

1

Global Pro...st.dll

windows7-x64

1

Global Pro...st.dll

windows10-2004-x64

1

Global Pro...me.jar

windows7-x64

1

Global Pro...me.jar

windows10-2004-x64

7

Global Pro...af.jar

windows7-x64

1

Global Pro...af.jar

windows10-2004-x64

7

Global Pro...op.exe

windows7-x64

1

Global Pro...op.exe

windows10-2004-x64

10

Global Pro...e.html

windows7-x64

1

Global Pro...e.html

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Global Pro...-0.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    139s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/02/2024, 08:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Global Protect Desktop/jre/bin/api-ms-win-core-debug-l1-1-0.dll

  • Size

    17KB

  • MD5

    3c47c25b8141d20b2b4d576000000a61

  • SHA1

    04543f9cdd847ff66389c9fd1e12b444dae6383a

  • SHA256

    290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956

  • SHA512

    c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a

  • SSDEEP

    384:M7eW5hWlo+10vq0GftpBj2uZwDkIldBQ7QMI:YkeinqDFQnI

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Global Protect Desktop\jre\bin\api-ms-win-core-debug-l1-1-0.dll",#1
    1⤵
      PID:3480

    Network

    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      183.59.114.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      183.59.114.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      79.121.231.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      79.121.231.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      180.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      180.178.17.96.in-addr.arpa
      IN PTR
      Response
      180.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-180deploystaticakamaitechnologiescom
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      187.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      187.178.17.96.in-addr.arpa
      IN PTR
      Response
      187.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-187deploystaticakamaitechnologiescom
    • 20.231.121.79:80
      104 B
       2
    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
       159 B
       1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      183.59.114.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      183.59.114.20.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      79.121.231.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      79.121.231.20.in-addr.arpa

    • 8.8.8.8:53
      180.178.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      180.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      187.178.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      187.178.17.96.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.