Overview

overview

3

Static

static

3

ForceCPU.exe

windows7-x64

1

ForceCPU.exe

windows10-2004-x64

1

HTCTL32.dll

windows7-x64

3

HTCTL32.dll

windows10-2004-x64

3

PCICHEK.dll

windows7-x64

1

PCICHEK.dll

windows10-2004-x64

1

PCICL32.dll

windows7-x64

1

PCICL32.dll

windows10-2004-x64

1

QWhale.Common.dll

windows7-x64

1

QWhale.Common.dll

windows10-2004-x64

1

QWhale.Editor.dll

windows7-x64

1

QWhale.Editor.dll

windows10-2004-x64

1

QWhale.Syntax.dll

windows7-x64

1

QWhale.Syntax.dll

windows10-2004-x64

1

Qt5QmlModels.dll

windows7-x64

1

Qt5QmlModels.dll

windows10-2004-x64

1

Qt5QuickWidgets.dll

windows7-x64

1

Qt5QuickWidgets.dll

windows10-2004-x64

1

Qt5SerialPort.dll

windows7-x64

1

Qt5SerialPort.dll

windows10-2004-x64

1

SimpleFilter.dll

windows7-x64

1

SimpleFilter.dll

windows10-2004-x64

1

TCCTL32.dll

windows7-x64

1

TCCTL32.dll

windows10-2004-x64

1

Timeline.dll

windows7-x64

1

Timeline.dll

windows10-2004-x64

1

api-ms-win...-0.dll

windows10-2004-x64

1

avcodec-58.dll

windows7-x64

3

avcodec-58.dll

windows10-2004-x64

3

avformat-58.dll

windows7-x64

3

avformat-58.dll

windows10-2004-x64

3

avutil-56.dll

windows7-x64

3

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 07:22 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Timeline.dll

  • Size

    51KB

  • MD5

    ec476c3ee3f7d463fc8b71a8da42e103

  • SHA1

    a32e85e618a4451feefed350f7fdb88dc662833d

  • SHA256

    25e20d696fa2d40cab80d6e45e998f63ef17564b4bacd978d98dbf4492be93ee

  • SHA512

    ec3c77cb84667aea1330dbeb9e5756a37f55570e4edc1bdde9c873e9218cfed6da2c0df57f4f3f9c2864cb664d1eb55700c95a1555d4bc5d485f0fc028c02c3b

  • SSDEEP

    768:BE8uqoL19VqLPLyYhH9L52OBRz6e4NPTijqhRR2fTMR2fT8BN266bC:YVqLPLyYhFcGzyijLx26O

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Timeline.dll,#1
    1⤵
      PID:2320
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4988

      Network

      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        133.211.185.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.211.185.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        69.31.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        69.31.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        154.239.44.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        154.239.44.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        104.219.191.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.219.191.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        183.59.114.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        183.59.114.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        105.246.116.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        105.246.116.51.in-addr.arpa
        IN PTR
        Response
      • 20.231.121.79:80
        46 B
         1
      • 13.107.246.64:443
        46 B
         40 B
         1
        1
      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
         128 B
         1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        133.211.185.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        133.211.185.52.in-addr.arpa

      • 8.8.8.8:53
        69.31.126.40.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        69.31.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        154.239.44.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        154.239.44.20.in-addr.arpa

      • 8.8.8.8:53
        104.219.191.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        104.219.191.52.in-addr.arpa

      • 8.8.8.8:53
        183.59.114.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        183.59.114.20.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        tls
        70 B
         156 B
         1
        1
      • 8.8.8.8:53
        105.246.116.51.in-addr.arpa
        dns
        73 B
         159 B
         1
        1

        DNS Request

        105.246.116.51.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.