Overview

overview

10

Static

static

10

Release/DcRat.exe

windows7-x64

10

Release/DcRat.exe

windows10-2004-x64

10

Release/Pl...io.dll

windows7-x64

1

Release/Pl...io.dll

windows10-2004-x64

1

Release/Pl...at.dll

windows7-x64

1

Release/Pl...at.dll

windows10-2004-x64

1

Release/Pl...ra.dll

windows7-x64

1

Release/Pl...ra.dll

windows10-2004-x64

1

Release/Pl...er.dll

windows7-x64

1

Release/Pl...er.dll

windows10-2004-x64

1

Release/Pl...er.dll

windows7-x64

1

Release/Pl...er.dll

windows10-2004-x64

1

Release/Pl...un.dll

windows7-x64

1

Release/Pl...un.dll

windows10-2004-x64

1

Release/Pl...on.dll

windows7-x64

1

Release/Pl...on.dll

windows10-2004-x64

1

Release/Pl...er.exe

windows7-x64

1

Release/Pl...er.exe

windows10-2004-x64

1

Release/Pl...er.dll

windows7-x64

1

Release/Pl...er.dll

windows10-2004-x64

1

Release/Pl...us.dll

windows7-x64

1

Release/Pl...us.dll

windows10-2004-x64

1

Release/Pl...at.dll

windows7-x64

1

Release/Pl...at.dll

windows10-2004-x64

1

Release/Pl...ns.dll

windows7-x64

1

Release/Pl...ns.dll

windows10-2004-x64

1

Release/Pl...er.dll

windows7-x64

1

Release/Pl...er.dll

windows10-2004-x64

1

Release/Pl...re.dll

windows7-x64

1

Release/Pl...re.dll

windows10-2004-x64

1

Release/Pl...ry.dll

windows7-x64

1

Release/Pl...ry.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    93s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2024, 16:53 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Release/Plugins/Chat.dll

  • Size

    387KB

  • MD5

    485874ca1ca6a970edbf93deacade012

  • SHA1

    d6d94a485d4a43f538d305178408f34c032ece60

  • SHA256

    eb772c641008eb5d441c37095a4e0b395748b0246f187d30a92c9284e56507fd

  • SHA512

    2d49477be64537841de35973575b0f1d3aa44cda9cbe76e3b53fc4d31c8156caa6e1a33af6a60892f912a683b1600a264f256d913ed1a90499796b493ba4aef8

  • SSDEEP

    6144:pX0cZsaB6N83r2y/plBWnxfID/uKNlNQ7fOiLXyCrxO9w+KQqxe/t3y:pkcZBB6NKbBWnxfIvNr4siQqxZ

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Release\Plugins\Chat.dll,#1
    1⤵
      PID:5096

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      181.129.81.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      181.129.81.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      69.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      69.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      197.87.175.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      197.87.175.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      48.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      48.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      134.130.81.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      134.130.81.91.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      217.106.137.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      217.106.137.52.in-addr.arpa

    • 8.8.8.8:53
      181.129.81.91.in-addr.arpa
      dns
      72 B
       147 B
       1
      1

      DNS Request

      181.129.81.91.in-addr.arpa

    • 8.8.8.8:53
      69.31.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      69.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      197.87.175.4.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      197.87.175.4.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      48.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      48.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      134.130.81.91.in-addr.arpa
      dns
      72 B
       147 B
       1
      1

      DNS Request

      134.130.81.91.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.