Overview

overview

10

Static

static

7

233f95c87f...31.exe

windows7-x64

7

233f95c87f...31.exe

windows10-2004-x64

7

2d8ea1230d...aa.exe

windows7-x64

10

2d8ea1230d...aa.exe

windows10-2004-x64

10

34dba85bb2...1a.exe

windows10-2004-x64

7

463d0b0903...ea.exe

windows7-x64

1

463d0b0903...ea.exe

windows10-2004-x64

1

4bcf45bde8...39.exe

windows7-x64

10

4bcf45bde8...39.exe

windows10-2004-x64

10

5292b8004f...ce.exe

windows7-x64

10

5292b8004f...ce.exe

windows10-2004-x64

10

6babc5b52d...53.dll

windows7-x64

3

6babc5b52d...53.dll

windows10-2004-x64

3

85b73b7b3c...45.exe

windows7-x64

10

85b73b7b3c...45.exe

windows10-2004-x64

10

8eb41b097a...ff.exe

windows7-x64

10

8eb41b097a...ff.exe

windows10-2004-x64

8

932380926b...ef.exe

windows7-x64

7

932380926b...ef.exe

windows10-2004-x64

7

9d8729b9ca...de.exe

windows7-x64

10

9d8729b9ca...de.exe

windows10-2004-x64

8

9e147a3bb2...53.dll

windows7-x64

8

9e147a3bb2...53.dll

windows10-2004-x64

8

bccfdc8e1a...96.exe

windows7-x64

7

bccfdc8e1a...96.exe

windows10-2004-x64

7

bf5a9bb619...d7.exe

windows7-x64

3

bf5a9bb619...d7.exe

windows10-2004-x64

3

d0017384df...0a.exe

windows7-x64

3

d0017384df...0a.exe

windows10-2004-x64

3

d72aa8fe30...89.exe

windows7-x64

3

d72aa8fe30...89.exe

windows10-2004-x64

7

fa622e0a4d...52.exe

windows7-x64

1

Resubmissions

15/11/2024, 18:05 UTC

241115-wpjcdsxrdy 10

11/11/2024, 21:40 UTC

241111-1h6xbsxcql 10

03/12/2022, 17:54 UTC

221203-wg4ncscc33 10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 21:40 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll

  • Size

    3.4MB

  • MD5

    4d536854aa5cbf1fc1c7d2cfc8ee65f6

  • SHA1

    d29e0930c73e808b394c082e372033b0e57bc8b9

  • SHA256

    6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853

  • SHA512

    1aa95fa137e5fc15b56f2155877f23e6609a440f22d143daff0436c0573ec75c528cb2a4af6d76b29085187ba2bc7ea105af65a89559445f248b466cd0079ad4

  • SSDEEP

    49152:naJlbM2hKrp949JqBaaI8zAlhSQrhF0Cph4D4QGpUFCU/rc6jQ6qv/:Ei94AIRSQrhF0K2DX6U/rk

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:444
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:8

Network

  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    136.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    136.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.117.19.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.117.19.2.in-addr.arpa
    IN PTR
    Response
    28.117.19.2.in-addr.arpa
    IN PTR
    a2-19-117-28deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.173.189.20.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    136.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    136.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    28.117.19.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    28.117.19.2.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    13.173.189.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    13.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.