Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-01-2025 10:53

General

  • Target

    Plugins/FileManager.dll

  • Size

    679KB

  • MD5

    641a8b61cb468359b1346a0891d65b59

  • SHA1

    2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0

  • SHA256

    b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd

  • SHA512

    042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee

  • SSDEEP

    12288:bVnchrRTHcQ3nrn6xtI9qR5WcygA5KeirCDD/:btJQ3nrnMI9MUlr5Kei+DD/

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FileManager.dll,#1
    1⤵
      PID:212

    Network

    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      7.98.51.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      7.98.51.23.in-addr.arpa
      IN PTR
      Response
      7.98.51.23.in-addr.arpa
      IN PTR
      a23-51-98-7deploystaticakamaitechnologiescom
    • flag-us
      DNS
      145.136.73.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      145.136.73.23.in-addr.arpa
      IN PTR
      Response
      145.136.73.23.in-addr.arpa
      IN PTR
      a23-73-136-145deploystaticakamaitechnologiescom
    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.163.245.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.163.245.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      181.129.81.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      181.129.81.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      88.65.42.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.65.42.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      5.114.82.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      5.114.82.104.in-addr.arpa
      IN PTR
      Response
      5.114.82.104.in-addr.arpa
      IN PTR
      a104-82-114-5deploystaticakamaitechnologiescom
    No results found
    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      145.136.73.23.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      145.136.73.23.in-addr.arpa

    • 8.8.8.8:53
      7.98.51.23.in-addr.arpa
      dns
      69 B
      131 B
      1
      1

      DNS Request

      7.98.51.23.in-addr.arpa

    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
      159 B
      1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      56.163.245.4.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      56.163.245.4.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      181.129.81.91.in-addr.arpa
      dns
      72 B
      147 B
      1
      1

      DNS Request

      181.129.81.91.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      88.65.42.20.in-addr.arpa
      dns
      70 B
      156 B
      1
      1

      DNS Request

      88.65.42.20.in-addr.arpa

    • 8.8.8.8:53
      5.114.82.104.in-addr.arpa
      dns
      71 B
      135 B
      1
      1

      DNS Request

      5.114.82.104.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.