Analysis
-
max time kernel
2s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
23/12/2023, 13:00
General
-
Target
BruteL4-DDOS.exe
-
Size
11.5MB
-
MD5
cb885b1cae29af6524d341c65e486828
-
SHA1
ef35f45fd7378e8fd31cd60f72bde21e75d61ada
-
SHA256
bd95ec107878109859ff396ef71c76eb801ed4b25a167b49c8f0b8e112fbe361
-
SHA512
9086e5a01178134876311086b14798e17d57f960c280b019e8f7e33fb68cdc494eb9be32918ec10314d8b8dfe289281567c82d132f1a5cf98288b8f133df2cde
-
SSDEEP
196608:it1/NlcaCs41CIpX5kuyN7PaxTCv3Dl6TzMjqWEocUlMh7G0B43aK8Uut3kWXWK9:C/YDj1CCh2zax+vz0mazUWG0q3pZU0vq
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Detects Pyinstaller 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\BruteL4-DDOS.exeC:\Users\Admin\AppData\Local\Temp\BruteL4-DDOS.exe 50.7.36.2502⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BruteL4DDOS.exe"C:\Users\Admin\AppData\Local\Temp\BruteL4DDOS.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\BruteL4DDOS.exe"C:\Users\Admin\AppData\Local\Temp\BruteL4DDOS.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BruteL4-DDOS.exeC:\Users\Admin\AppData\Local\Temp\BruteL4-DDOS.exe 50.7.36.2502⤵
-
C:\ProgramData\microsoft\MpDlpCmd.exe"C:\ProgramData\microsoft\MpDlpCmd.exe"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mode 140, 401⤵
-
C:\Windows\system32\mode.commode 140, 402⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title Brute - by billythegoat3561⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD548d176927fc0022dfdb389de832a1afb
SHA17134458b63d27676c81a3bb4826349042a288dc8
SHA256b72d7d09e0ed95c3cbb6e852a0378398a160fce8a715e384c72c22992c7a2c76
SHA512e1f3a334f5e9d3e98fbf056b58ca4337d7a8a88bfc30bfc12a6329f08b240101df312cc96f74c8da25ecfed3257a919b43a6a1d9d1ecaee617355341da029e57
-
Filesize
92KB
MD595a44bfdfb250144e9467969d4d05cc2
SHA178488728660375f7d118ee8dad12fe1bb920135c
SHA2565b246709be3787e7b477166673c2b27e6c70207f423f0b9a84628db5d0ccc2c8
SHA512fec58b4c1bcac008103bc080c7306e42a7bac628506795e0d2db831aeceabee6c4e21fbd94ffc438ff66643b8a973394a77b64eb3157357108426d18c8b90174
-
Filesize
99KB
MD50d0197cbac7d626157a4bad82273e7ef
SHA1ec2e72dec7ab22012ae5235e21300c74702b6068
SHA256cbd2df414872c8184a2bcc6b0e55f20cc21b312b3c7f610bcda076e7548f4c24
SHA512aa6f3fb3b775c17ebbee2be51d19d4a1d30d9565d71d2900bdecec2e789495b622131fa6437a65450450711672fc950e762a36694007acb55e34f047edd39f77
-
Filesize
859B
MD56e11a15fe4491ead2a94f64d3467be38
SHA19a8329fb71ddc89dae9aa174c0b44a1f646efd63
SHA256087cf6355ae9fc71eea2493b30c6b10a6775f3dd68b2cb5e07fcc13461b74248
SHA5126154e320e2556aef177fc5bfb4e5fe8fabe324af736b89db4db41e6dd51658f7f6a7d0f73c24dc6ccdc4edf14023f4a1ecd0908abac5b82cebd038a93b2fc106
-
Filesize
294KB
MD5589222cd4793285367701d86b1dc9684
SHA1528c638595774dd53b55d2f8fe628305010f8bac
SHA256825df677e0c3c814cc84a2503fd690edff6605449d3c11d21c96b4ef91bdf6a9
SHA5120ad0bf52b8ea3e6498fe440ad7d7f98d9c98119b3b7beb11090f7b10b1c641c3c040c3c2ef1008afa09cc0282d711a7a739a16a8b58c33935998236f503767fe
-
Filesize
511KB
MD530b04b2e696bcacbbc66409220d07f43
SHA113eff60dcb46a2adbb036233b4680627f07e85d4
SHA256737018eaf894090abedfb9726d5b7019d02f1e613ed317c24193d54fa6958e96
SHA512a28f9d445e9567cc64d03f6f5c5f987246bb21e53b0dad6a5d150c464eb9125537bdfefed4cbd5c67026181a1730575deeeba39022709ca48b7d11325001f683
-
Filesize
179KB
MD5feab9ce6f4fa854bfef2f7971a34c43a
SHA187afe443402a58d45ff1b639c569eeede2d9e996
SHA25659f8837b8299e903e68442e2aef0d2492b1f0c1571a6a803f50e6b5486f99369
SHA512ecdec2c79063b9c072c270bd1ba445d0fa346087ec8030a3c25151ab08e6f862cee5244f85680210f7fb779a731049017c1832c7a5f0874dc9f9c38fc2523395
-
Filesize
21KB
MD501be1734514d9f36cdd50b07a10a9e0b
SHA1743b4569dcd2bfb03d70d3afe873d150a3bc2fcc
SHA256e6ceb1c689fa8252b6ab6a7f24de2461a5e77e9dd8c3beb533ff718d915015c1
SHA512daf4a9fb30b8156ee56af1dd3124cf1de8c42cc95add1d5b795f66d853df5914449c9188a53132cd6596ee57571b38e03a8ab79c757bd55b9edbd91f1bbbdd3e
-
Filesize
94KB
MD5a87575e7cf8967e481241f13940ee4f7
SHA1879098b8a353a39e16c79e6479195d43ce98629e
SHA256ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
SHA512e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
-
Filesize
35KB
MD5058d5d7eb203c8a99042c5f3a5171a57
SHA1826f8917a3678b47cc2a2097a5340773c84e8fdd
SHA2561988905d6e11945cca9d62ea59479c7e54ae67e4ec360237f6270dffdf665724
SHA512fd2383e2b442a073f505259f5409caa3cf8eaf358315bcbbe39afd590fe5f98e3f8647825daf5abda4a8ee895ee10dffd1323749db318780f5881ee31991e421
-
Filesize
54KB
MD5e28acb3e65ad0b0f56bbfa07a5524289
SHA1a36cebfed6887d32fc005cd74da22648e7ec8e6c
SHA256269a4c6d8deeb6cf5739573c71d1cfe1398f8d1a1508d1149efa926fd49138c9
SHA512527e1ab1638090e5c5f005a319d548c9bf0a530389ab82e4fe314cc7a6ac59ba74715b6e38a90f82ad3acd32533c0285b90f8b4b3b89b55ed31a8235ee835284
-
Filesize
35KB
MD5410c818711f1d3ffa4362d7e1ba4ea31
SHA175fbc8c9cd173b5e8b8118e2440b40b621625e78
SHA256f9506c0f6bb6fe4993eeac809f574e294c1f091344c42970798507d110fa9ced
SHA51206026ba5edd8cea73531958ec4021a94b8524d8e9785197de9bb3991c83a9d43f09f17adf71b9561e0104dc68aa616efb819279f3b794fe9b213036931165194
-
Filesize
38KB
MD579ca909a112bf7e02eebbeb24c7fea66
SHA15c3724b1b715365b2754f91e73d044b2673f3903
SHA256f5aa56e1e206c680d02f398a9eeeb9e9986246178f616c59494c09aaf24d71d3
SHA512227fa2adcd9b9fd8058fe09c2918ef8e1ada50b5b58fc7898a0851086160f83a4fab8b934979a1e2d28449f30b0a689c2c096ea1c70779fb6b1daef564f9b980
-
Filesize
14KB
MD5243422511d3be703898afacba8dabc5e
SHA11747ac333cb97b321335f7339f000def6ee20643
SHA256969beea3bd31d05bb6bca9c4a8b9227d2392c16cd61ef1a909fc8aa1ce6109d5
SHA512d43cdff741b8049334ab44bd820c577f44e7fe2f38035fb5e42686a1f881c1dd5fe950e1f85d9a75764381769699b964ec1a3c74023c94e71337fed19971f9b9
-
Filesize
121KB
MD5c2aba6a1c11006273f942e9c026cad40
SHA1c8e584978b0232447f7aeb085cea6255314741f0
SHA2569c5348a80f64eda8972eaeeeb0d58aee8d666b32df8d00b94044a486a2ee70b5
SHA51273f9f11f25c476a7bb9b1f3a8c11ab2bb014eb2c2f0bd39c07112263fd280567abc736592f965146072e1036f83b59998e52cf5dd7392a5de25a952d87f510fe
-
Filesize
23KB
MD5b5150b41ca910f212a1dd236832eb472
SHA1a17809732c562524b185953ffe60dfa91ba3ce7d
SHA2561a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a
SHA5129e82b0caa3d72bb4a7ad7d66ebfb10edb778749e89280bca67c766e72dc794e99aab2bc2980d64282a384699929ce6cc996462a73584898d2df67a57bff2a9c6
-
Filesize
84KB
MD5e679c2ca8455212b493bc37afb31d00f
SHA1f0994a2dfe989ebf27e68b839c49a51dd0695632
SHA2560c12b365ab6499cbba2a47c27c539c2727afb0edc72596a3a9588dd952d3681d
SHA512c7a3a1a4ebfc19e9708bf76369894555e8fc2c76503f308697f1130ece82a790ca08feff89e558ec114f11506792b5fed886ea1f2aee694aece38475b42ec3b8
-
Filesize
140KB
MD5263b1d0f5b10b64959e7031c90e0573b
SHA11a68289eaf2fd65e539b95456fc71f09b61035da
SHA256c738c0ea9bf1527e22fc48f012f4201e7652ecc7da7260706b835b82c23c5194
SHA512c25cd14d8774ba2fe66db096a334a835cd0ccd30e65736c290c54bf6c492a39efcd66dfcf0b1be12e6c09ea3d4aca72d845b8af960432f7abd65add0760e071d
-
Filesize
21KB
MD56b060423e9286414cd6529d4ae6fcda5
SHA141f0f83c395a936b313001307cbbe2f01224fa35
SHA2566ee51b502c418c8a6d3e5c13f22bee6f72503043ac33b4f1ac01adf7531557ae
SHA51204256d6fb99296c6b3c29fd69b0f90ac1eb8a25c2e7750b3fda4a145d5d9bc7a6e5d5b3691c0784c810f3e7cea3f080325d6cec2901ed206b57dcf1b6777e4ff
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
144KB
-
Filesize
100KB
-
Filesize
52KB
-
Filesize
60KB
-
Filesize
4.4MB
-
Filesize
144KB
-
Filesize
4.4MB
-
Filesize
14.9MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
14.9MB
-
Filesize
14.9MB
-
Filesize
14.9MB
-
Filesize
14.9MB
-
Filesize
14.9MB
-
Filesize
14.9MB
-
Filesize
14.9MB
-
Filesize
14.9MB
-
Filesize
14.9MB
-
Filesize
14.9MB
-
Filesize
16.0MB
-
Filesize
8.3MB
-
Filesize
16.0MB
-
Filesize
2.8MB
-
Filesize
16.0MB
-
Filesize
8.0MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
10.8MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
8KB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
3.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
7.6MB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
16.0MB
-
Filesize
10.8MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
3.8MB
-
Filesize
12.7MB
-
Filesize
16.0MB
-
Filesize
12.7MB
-
Filesize
12.7MB