Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
12/07/2024, 15:16 UTC
General
-
Target
dheater-0.4.3/MANIFEST.in
-
Size
38B
-
MD5
2c7552976ede5ac596ca9e063c878c29
-
SHA1
0f02da4337e2b08200d7906c3266c3ebd9b30430
-
SHA256
2a32f4e9627f74e82c3f7f959c77ecaa69f2f8662a01e6acfdd994558e5218af
-
SHA512
a40921eda77b79c440ae533d5b6bd899ba7f5929821e7a43e2c9b991b9ab7dd269360feb5c3d12a8a37c6fb78daf23dad6e8fd995265c6673695a6932c57ece3
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\dheater-0.4.3\MANIFEST.in1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS97.12.20.2.in-addr.arpaRemote address:8.8.8.8:53Request97.12.20.2.in-addr.arpaIN PTRResponse97.12.20.2.in-addr.arpaIN PTRa2-20-12-97deploystaticakamaitechnologiescom
-
DNS138.201.86.20.in-addr.arpaRemote address:8.8.8.8:53Request138.201.86.20.in-addr.arpaIN PTRResponse
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS92.12.20.2.in-addr.arpaRemote address:8.8.8.8:53Request92.12.20.2.in-addr.arpaIN PTRResponse92.12.20.2.in-addr.arpaIN PTRa2-20-12-92deploystaticakamaitechnologiescom
-
DNS240.221.184.93.in-addr.arpaRemote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
DNS29.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:5397.12.20.2.in-addr.arpadns
DNS Request
97.12.20.2.in-addr.arpa
-
8.8.8.8:53138.201.86.20.in-addr.arpadns
DNS Request
138.201.86.20.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
8.8.8.8:5392.12.20.2.in-addr.arpadns
DNS Request
92.12.20.2.in-addr.arpa
-
8.8.8.8:53240.221.184.93.in-addr.arpadns
DNS Request
240.221.184.93.in-addr.arpa
-
8.8.8.8:5329.243.111.52.in-addr.arpadns
DNS Request
29.243.111.52.in-addr.arpa