aa6d77b243f9397fc5ab618f515a9dc82358c93d94cc270bd9d4f98910ee4da5 | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2024, 11:54 UTC

Sharing

Report Analysis Logs

General

Target

Bltools 2.9.1[PRO]/Bltools 2.9.1[PRO]/Microsoft.Xaml.Behaviors.dll
Size

142KB
MD5

95f46f34c099421d917d5feadbb33edb
SHA1

3d1cb9cf59000012734901a35baeb3d9c1dd5db3
SHA256

8e77a1dd5e2df4d4af801376cc3428b082eb49fcb6e647b933967fae12ad9d5d
SHA512

c9c9f72980316c68ad2a8dbe2c6c563c0deddfc9e845674d0e2f5313a0ae285d60a755e2ca04164f78b37a36521259307b3eb7d43f5ec9a9de5507bda7e4c1b8
SSDEEP

3072:lN+EM1X0WlL9JAn11M1dXcGkOsizI35rCj8SIP:v+ll79in1h6

Score

1^/10

Malware Config

Signatures

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Bltools 2.9.1[PRO]\Bltools 2.9.1[PRO]\Microsoft.Xaml.Behaviors.dll",#1
1⤵
PID:4608

Network

DNS

23.236.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

23.236.111.52.in-addr.arpa

IN PTR

Response
DNS

27.173.189.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

27.173.189.20.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

23.236.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

23.236.111.52.in-addr.arpa
8.8.8.8:53

27.173.189.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

27.173.189.20.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads