Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 13:39 UTC
General
-
Target
4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
-
Size
660KB
-
MD5
54a315b26c66694821fb2091ef865f7f
-
SHA1
9f79ec5e7845bd33a58124fd3d10637a20630bb5
-
SHA256
4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef
-
SHA512
625e851ddedd83103d1b27c25bdb8428e8aab9321436d48668112dd887f9ede5655b4f5b13d69e656bae522951c50cedd53426de725788ba5697089e81156814
-
SSDEEP
12288:nBxT3SKVIC9HdFEtttJl3Mob+60MCV94D0cIegdu1oeK/lGRgOUqmq9kR6lhKXhh:BxT3ZVB9HdFQPl3M06MCV9k0DegduieE
Score
10/10
Malware Config
Extracted
Family
netdooka
C2
Signatures
-
NetDooka
NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"2⤵
-
Network
-
DNS20.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request20.160.190.20.in-addr.arpaIN PTRResponse -
DNS20.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request20.160.190.20.in-addr.arpaIN PTR
-
DNS20.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request20.160.190.20.in-addr.arpaIN PTR
-
DNS241.154.82.20.in-addr.arpaRemote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
DNS0.204.248.87.in-addr.arpaRemote address:8.8.8.8:53Request0.204.248.87.in-addr.arpaIN PTRResponse0.204.248.87.in-addr.arpaIN PTRhttps-87-248-204-0lhrllnwnet
-
DNS26.35.223.20.in-addr.arpaRemote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
DNS132.250.30.184.in-addr.arpaRemote address:8.8.8.8:53Request132.250.30.184.in-addr.arpaIN PTRResponse132.250.30.184.in-addr.arpaIN PTRa184-30-250-132deploystaticakamaitechnologiescom
-
DNS9.228.82.20.in-addr.arpaRemote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS103.169.127.40.in-addr.arpaRemote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
DNS65.139.73.23.in-addr.arpaRemote address:8.8.8.8:53Request65.139.73.23.in-addr.arpaIN PTRResponse65.139.73.23.in-addr.arpaIN PTRa23-73-139-65deploystaticakamaitechnologiescom
-
DNS240.197.17.2.in-addr.arpaRemote address:8.8.8.8:53Request240.197.17.2.in-addr.arpaIN PTRResponse240.197.17.2.in-addr.arpaIN PTRa2-17-197-240deploystaticakamaitechnologiescom
-
DNS249.197.17.2.in-addr.arpaRemote address:8.8.8.8:53Request249.197.17.2.in-addr.arpaIN PTRResponse249.197.17.2.in-addr.arpaIN PTRa2-17-197-249deploystaticakamaitechnologiescom
-
DNS19.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5320.160.190.20.in-addr.arpadns
DNS Request
20.160.190.20.in-addr.arpa
DNS Request
20.160.190.20.in-addr.arpa
DNS Request
20.160.190.20.in-addr.arpa
-
8.8.8.8:53241.154.82.20.in-addr.arpadns
DNS Request
241.154.82.20.in-addr.arpa
-
8.8.8.8:530.204.248.87.in-addr.arpadns
DNS Request
0.204.248.87.in-addr.arpa
-
8.8.8.8:5326.35.223.20.in-addr.arpadns
DNS Request
26.35.223.20.in-addr.arpa
-
8.8.8.8:53132.250.30.184.in-addr.arpadns
DNS Request
132.250.30.184.in-addr.arpa
-
8.8.8.8:539.228.82.20.in-addr.arpadns
DNS Request
9.228.82.20.in-addr.arpa
-
8.8.8.8:5318.31.95.13.in-addr.arpadns
DNS Request
18.31.95.13.in-addr.arpa
-
8.8.8.8:53103.169.127.40.in-addr.arpadns
DNS Request
103.169.127.40.in-addr.arpa
-
8.8.8.8:5365.139.73.23.in-addr.arpadns
DNS Request
65.139.73.23.in-addr.arpa
-
8.8.8.8:53240.197.17.2.in-addr.arpadns
DNS Request
240.197.17.2.in-addr.arpa
-
8.8.8.8:53249.197.17.2.in-addr.arpadns
DNS Request
249.197.17.2.in-addr.arpa
-
8.8.8.8:5319.229.111.52.in-addr.arpadns
DNS Request
19.229.111.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
124KB
-
Filesize
7.7MB