Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 13:39
Static task
static1
Behavioral task
behavioral1
Sample
4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
General
-
Target
4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
-
Size
660KB
-
MD5
54a315b26c66694821fb2091ef865f7f
-
SHA1
9f79ec5e7845bd33a58124fd3d10637a20630bb5
-
SHA256
4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef
-
SHA512
625e851ddedd83103d1b27c25bdb8428e8aab9321436d48668112dd887f9ede5655b4f5b13d69e656bae522951c50cedd53426de725788ba5697089e81156814
-
SSDEEP
12288:nBxT3SKVIC9HdFEtttJl3Mob+60MCV94D0cIegdu1oeK/lGRgOUqmq9kR6lhKXhh:BxT3ZVB9HdFQPl3M06MCV9k0DegduieE
Malware Config
Extracted
Family
netdooka
C2
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3540 set thread context of 3808 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 88 -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3540 wrote to memory of 3808 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 88 PID 3540 wrote to memory of 3808 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 88 PID 3540 wrote to memory of 3808 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 88 PID 3540 wrote to memory of 3808 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 88 PID 3540 wrote to memory of 3808 3540 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"2⤵PID:3808
-