Overview

overview

10

Static

static

10

Makala Executor.zip

windows7-x64

1

Makala Executor.zip

windows10-2004-x64

1

Makala Exe...ox.dll

windows7-x64

1

Makala Exe...ox.dll

windows10-2004-x64

1

Makala Exe...I2.dll

windows7-x64

1

Makala Exe...I2.dll

windows10-2004-x64

1

Makala Exe...er.exe

windows7-x64

10

Makala Exe...er.exe

windows10-2004-x64

10

Makala Exe...config

windows7-x64

3

Makala Exe...config

windows10-2004-x64

3

Makala Exe...la.pdb

windows7-x64

3

Makala Exe...la.pdb

windows10-2004-x64

3

Makala Exe...UI.dll

windows7-x64

1

Makala Exe...UI.dll

windows10-2004-x64

1

Makala Exe...no.dll

windows7-x64

1

Makala Exe...no.dll

windows10-2004-x64

1

Makala Exe...64.dll

windows7-x64

1

Makala Exe...64.dll

windows10-2004-x64

1

Makala Exe...64.dll

windows7-x64

1

Makala Exe...64.dll

windows10-2004-x64

1

Makala Exe...sh.dll

windows7-x64

1

Makala Exe...sh.dll

windows10-2004-x64

1

Makala Exe...td.dll

windows7-x64

1

Makala Exe...td.dll

windows10-2004-x64

1

Makala Exe...er.txt

windows7-x64

1

Makala Exe...er.txt

windows10-2004-x64

1

Makala Exe...is.dll

windows7-x64

1

Makala Exe...is.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    95s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/12/2024, 23:48 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Makala Executor/Makala.pdb

  • Size

    49KB

  • MD5

    5ecbd7ca622c4e0f344e754cfabd6fef

  • SHA1

    e97af1ad1ea3d36293cb3d178ddb63e8dd730af5

  • SHA256

    257b45becadd3bb8e33fe89f6a14b65d079e00ac4aa564436f15f8efcf9e8204

  • SHA512

    fedd453b3bf64a293fcc8c189a823d567bd998622d99f31cf94b19e55fc2b5f14210cdbcb97fc5f57d1f2d5be870599cedb7e513d52c1efcc81eef167edd86e8

  • SSDEEP

    768:tSJCJF8z+s28VenBT5oDYlHla8z+s2j9DY:0Ve9CCHG9

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Makala Executor\Makala.pdb"
    1⤵
    • Modifies registry class
    PID:4880
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4464

Network

  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    21.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    182.129.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    182.129.81.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    21.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    21.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    182.129.81.91.in-addr.arpa
    dns
    72 B
     147 B
     1
    1

    DNS Request

    182.129.81.91.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.