00a2f8b99cd817f8c7fc4c449033015f039d18af213de78cb66bf202277c0628 | Triage

Resubmissions

23/02/2024, 17:18

240223-vvsmkseh31 3

23/02/2024, 17:14

240223-vrz79adh39 8

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 17:18

Sharing

Report Analysis Logs

General

Target

goodbyedpi-0.2.2/2_any_country_dnsredir.cmd
Size

291B
MD5

48de91946fd423515b182a622842adc5
SHA1

4519a0bc87a0e0838f003d3e4e4904d5721abad7
SHA256

a7762f252e434134245adee7398eabc7b96e4e83ee408ce63cc3f92b942c4b6b
SHA512

43ef99d5f0ed8725cfad206d6d3bd0d393258872882f3c2fd8f974703dfb418652f9f1adae5b6e9ab769cf9a46192655c795c4ebc0adf4cd6a1b4e7cd20db745

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2276	2292	cmd.exe	29
PID 2292 wrote to memory of 2276	2292	cmd.exe	29
PID 2292 wrote to memory of 2276	2292	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\2_any_country_dnsredir.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253
  2⤵
  PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-0-0x000000013F7A0000-0x000000013F7BB000-memory.dmp

Filesize
108KB

Download
memory/2276-1-0x0000000062800000-0x000000006280D000-memory.dmp

Filesize
52KB

Download
memory/2276-2-0x000000013F7A0000-0x000000013F7BB000-memory.dmp

Filesize
108KB

Download