Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
04/03/2025, 21:33
Static task
static1
Behavioral task
behavioral1
Sample
242940.ocx.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
242940.ocx.dll
Resource
win10v2004-20250217-en
General
-
Target
242940.ocx.dll
-
Size
2.2MB
-
MD5
ccdd5e4104d5aa3503a8fa9ef1455241
-
SHA1
b0ac2201c86823c175ec532d472a41afbab887a0
-
SHA256
828eee78537e49b46e34a754306ccf67f6281b77e5caeaf53132a32b6b708e5c
-
SHA512
1f39f7341a2a9e938d1742e3a2bb9ec663fb226f4a93aad5a3fdaf68e803eef4a39594d159e2d96bf23c733c27dad85d13fb92e60164721a34fa5920681f8da2
-
SSDEEP
49152:wEMcIDsq2EKwnQXvoXcUiEMxv/VqeXqXcL/CK+:+w8cUiEMxv/VqekOR
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ifconfig.me -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1724 regsvr32.exe 1724 regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149B
MD53b70edb0bd69254e723686d5274f0d1d
SHA1a29b36ca33226e90a08c0454451292255d8abd13
SHA2561344b2fa1cd6247c6d104e2c8829ca840ee2fd17576863066ec25c79c9c0bf64
SHA512e81722a12b637321360a0b941e405e5497925694020c56ac9f00837cc27c6f109e090c05e2f2335a8f8b91f40b492804cc896e773e86c81a683ade477b33f59d
-
Filesize
41B
MD5b8aa163f92ac37168e27450c65f8604f
SHA1eb18995210567d33e1e475153a85dd45358ac9bb
SHA256c5d67bf8fa51748f8baac8a9cef6463e6e5852272bb58af29c429c0ae36a7380
SHA512e987f442230b5c45e1767e42938be47413011c29831cf2b031c258619034926aff5ab3efbaeda8ab91e05514021f17ca15ab9be1f73cda86dbbddf056c2b8ae6