00a2f8b99cd817f8c7fc4c449033015f039d18af213de78cb66bf202277c0628 | Triage

Resubmissions

23/02/2024, 17:18

240223-vvsmkseh31 3

23/02/2024, 17:14

240223-vrz79adh39 8

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 17:18

Sharing

Report Analysis Logs

General

Target

goodbyedpi-0.2.2/1_russia_blacklist_dnsredir.cmd
Size

327B
MD5

f73c24aa2a64a897d88fee8787a48847
SHA1

96b91f1ea3322111617a52dfff5bbf7e5f2ebbe2
SHA256

cebffbb31125a1ac8abd68012bb413bac6da56258f0d4fa95dcb2f23e94b4779
SHA512

2b2bc84c284a86769e0a703f5548b463f70aedbfce2f05421d630bfbeeb12d67991c01f91184e45ed5e5681d45aeb209798f459ed68a776c77976ffaa44724b5

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2972	1312	cmd.exe	29
PID 1312 wrote to memory of 2972	1312	cmd.exe	29
PID 1312 wrote to memory of 2972	1312	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\1_russia_blacklist_dnsredir.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253 --blacklist ..\russia-blacklist.txt
  2⤵
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-0-0x000000013FB60000-0x000000013FB7B000-memory.dmp

Filesize
108KB

Download
memory/2972-1-0x0000000062800000-0x000000006280D000-memory.dmp

Filesize
52KB

Download
memory/2972-4-0x000000013FB60000-0x000000013FB7B000-memory.dmp

Filesize
108KB

Download