577ebca3d2c49cd3ef9130d3ffc0333369877a92e451c25e3ddd9be4d0860254 | Triage

Analysis

max time kernel
300s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
29-03-2024 18:25

Sharing

Report Analysis Logs

General

Target

GoDm/source.exe
Size

13.5MB
MD5

5df1ae0ac565c650821135785b158021
SHA1

25d21ca9c049a6ab821734093a58c1b9fd7789e4
SHA256

43f604cdb1bc8ceab09dfffe2198e7d7829712ab834a1c5c7fe5171c8c5368fb
SHA512

fc734695cdc694e218675aeea07386e35a47b2f23a71608ef07be10f5a1e80dcc24b6177d28597a74a06cb4a65cab5506bfc5d197a3a420f61b6a52e29aa1da0
SSDEEP

196608:sZhXsph78ipqLZINPMTQB6YoTu19lcviP1sfGbbU0:7L78BLZdTQB6Yok9lco1P3

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 discord.com
4 discord.com
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

source.exe

description pid process target process

PID 964 wrote to memory of 2800 964 source.exe cmd.exe
PID 964 wrote to memory of 2800 964 source.exe cmd.exe

C:\Users\Admin\AppData\Local\Temp\GoDm\source.exe
"C:\Users\Admin\AppData\Local\Temp\GoDm\source.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\system32\cmd.exe
cmd /c cls
2⤵
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-2-0x000002217B660000-0x000002217BA60000-memory.dmp

Filesize
4.0MB

Download