Analysis

  • max time kernel
    92s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-01-2025 10:53

General

  • Target

    Plugins/HRDP.dll

  • Size

    1.7MB

  • MD5

    f27b6e8cf5afa8771c679b7a79e11a08

  • SHA1

    6c3fcf45e35aaf6b747f29a06108093c284100da

  • SHA256

    4aa18745a5fddf7ec14adaff3ad1b4df1b910f4b6710bf55eb27fb3942bb67de

  • SHA512

    0d84966bbc9290b04d2148082563675ec023906d58f5ba6861c20542271bf11be196d6ab24e48372f339438204bd5c198297da98a19fddb25a3df727b5aafa33

  • SSDEEP

    24576:3rKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:WHZ5pdqYH8ia6GcKuR7

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\HRDP.dll,#1
    1⤵
      PID:1888

    Network

    • flag-us
      DNS
      123.136.73.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      123.136.73.23.in-addr.arpa
      IN PTR
      Response
      123.136.73.23.in-addr.arpa
      IN PTR
      a23-73-136-123deploystaticakamaitechnologiescom
    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      75.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      75.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      5.114.82.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      5.114.82.104.in-addr.arpa
      IN PTR
      Response
      5.114.82.104.in-addr.arpa
      IN PTR
      a104-82-114-5deploystaticakamaitechnologiescom
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.163.245.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.163.245.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      136.136.73.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      136.136.73.23.in-addr.arpa
      IN PTR
      Response
      136.136.73.23.in-addr.arpa
      IN PTR
      a23-73-136-136deploystaticakamaitechnologiescom
    • flag-us
      DNS
      145.136.73.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      145.136.73.23.in-addr.arpa
      IN PTR
      Response
      145.136.73.23.in-addr.arpa
      IN PTR
      a23-73-136-145deploystaticakamaitechnologiescom
    • flag-us
      DNS
      23.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      23.236.111.52.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      123.136.73.23.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      123.136.73.23.in-addr.arpa

    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      75.159.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      75.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      5.114.82.104.in-addr.arpa
      dns
      71 B
      135 B
      1
      1

      DNS Request

      5.114.82.104.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      56.163.245.4.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      56.163.245.4.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      136.136.73.23.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      136.136.73.23.in-addr.arpa

    • 8.8.8.8:53
      145.136.73.23.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      145.136.73.23.in-addr.arpa

    • 8.8.8.8:53
      23.236.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      23.236.111.52.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.