aresloader | 7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2023 23:02

Target

nigga.exe
Size

1.5MB
MD5

82acd827f36e29c05e6581558b0d76ca
SHA1

bd43089a78e97b66064b37d72f086f4c042a4c91
SHA256

7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb
SHA512

cdf9077fb0c06a9fc38dc0aa630345adfb65bfb264d03d7b56b0961f02798f8bce49fcfa28fd40671a02e1e385ac0c4c2a3f914b1d0b64a844462be2127b261f
SSDEEP

24576:f/f6OAqD+EoVeQExeVATaXAuQ5x3f3TWH5x:faOAU+M/WH5x

Score

10^/10

aresloader loader

Family

aresloader

http://45.80.69.193

AresLoader
AresLoader is a loader and downloader written in C++.
loader aresloader

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ipinfo.io
13	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4224 set thread context of 1096	4224	nigga.exe	84

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 4224 wrote to memory of 1096	4224	nigga.exe	84
PID 1096 wrote to memory of 2156	1096	nigga.exe	85
PID 1096 wrote to memory of 2156	1096	nigga.exe	85
PID 1096 wrote to memory of 2156	1096	nigga.exe	85
PID 2156 wrote to memory of 3624	2156	cmd.exe	87
PID 2156 wrote to memory of 3624	2156	cmd.exe	87
PID 2156 wrote to memory of 3624	2156	cmd.exe	87

C:\Users\Admin\AppData\Roaming\MicrosoftSetup\MsMpEng.exe

Filesize
153B

MD5
cd31d1bda62e6c59e395bcd54ea7b23f

SHA1
8be312a526cda4e722942b168514c5a25ad57870

SHA256
5c829b1bc9a371935075b06108fa9f9aa1d2f00098db46650d6bea3d58099da0

SHA512
4e960c9794b0cbdcc375d4f8844d8ffb5ddbab73fdb1ff96b95859eac41118e48b27c23aa90b9737ca2fa3c87505e12466b966ad2f55d396bbd4ab0efa3a13ea

Download Submit
memory/1096-3-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/1096-5-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/1096-6-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/1096-21-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4224-1-0x0000000002E90000-0x0000000002F90000-memory.dmp

Filesize
1024KB

Download
memory/4224-2-0x0000000004A40000-0x0000000004B7D000-memory.dmp

Filesize
1.2MB

Download