Overview

overview

3

Static

static

1

Slot_Bot_Src_DreX.zip

windows7-x64

1

Slot_Bot_Src_DreX.zip

windows10-2004-x64

1

main (3).py

windows7-x64

3

main (3).py

windows10-2004-x64

3

mention_log (1).json

windows7-x64

3

mention_log (1).json

windows10-2004-x64

3

mention_log (1.json

windows7-x64

3

mention_log (1.json

windows10-2004-x64

3

slots (1).json

windows7-x64

3

slots (1).json

windows10-2004-x64

3

slots (1).txt

windows7-x64

1

slots (1).txt

windows10-2004-x64

1

vouches (1).json

windows7-x64

3

vouches (1).json

windows10-2004-x64

3

Analysis

  • max time kernel
    93s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 12:10 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    main (3).py

  • Size

    13KB

  • MD5

    792355fdb3a8c90fa40309dbee239870

  • SHA1

    02fbf862cf06d0b72a9839efdc47c5c676979f95

  • SHA256

    8dc6bc32e52d212a9eb49af533e36c1f69e29f22efd127d76cb1a6939773de71

  • SHA512

    06e7edfa88456e1142bdb9425236f388a8b2b6d4ff9c6b9064127069af9e1f6e895e22433c5494353b7eca3b495a8a1a53b018954b5ce2f6c6cbb5e0cab644e0

  • SSDEEP

    384:znO9VEw7LtxYvqIsYAdmU8SC9zqe0jAQzLBvOA3T:znO9VP7tYA187FH0jAQzLBvOA3T

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\main (3).py"
    1⤵
    • Modifies registry class
    PID:4504
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2360

Network

  • flag-us
    DNS
    240.197.17.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.197.17.2.in-addr.arpa
    IN PTR
    Response
    240.197.17.2.in-addr.arpa
    IN PTR
    a2-17-197-240deploystaticakamaitechnologiescom
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    144.211.222.173.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    144.211.222.173.in-addr.arpa
    IN PTR
    Response
    144.211.222.173.in-addr.arpa
    IN PTR
    a173-222-211-144deploystaticakamaitechnologiescom
No results found
  • 8.8.8.8:53
    240.197.17.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    240.197.17.2.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    144.211.222.173.in-addr.arpa
    dns
    74 B
     141 B
     1
    1

    DNS Request

    144.211.222.173.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.