Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 01:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HexaPort.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
HexaPort.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
HexaPort.dll
-
Size
514KB
-
MD5
2386ff4241e16fcca5481606a1424bf7
-
SHA1
f1d299336aac1a1314b36064ffa9ae12ebdb3e4c
-
SHA256
a9f2c4bc268765fc6d72d8e00363d2440cf1dcbd1ef7ee08978959fc118922c9
-
SHA512
5d31aec494217835d8da4c8b3b3a85c8aea148fa484ab2b348546154470aa96d64a205d4aa3909cc337b791a7daa2daea76a0c5b00660daef818e7883e078cdc
-
SSDEEP
12288:+lCodWFCE5bMQSuXYKwJCGZsv7y+eU6u:+lCodWFCwb/HwJh8HOu
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4164 msedge.exe -
Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 Destination IP 45.61.152.154 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3456 set thread context of 4164 3456 regsvr32.exe 82 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 3460 Explorer.EXE 3460 Explorer.EXE 3460 Explorer.EXE 3460 Explorer.EXE 3460 Explorer.EXE 3460 Explorer.EXE 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe 4164 msedge.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3456 wrote to memory of 4164 3456 regsvr32.exe 82 PID 4164 wrote to memory of 3460 4164 msedge.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3460 -
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\HexaPort.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\??\C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4164
-
-