70d58a06d5537d78434d74b5fc67d6a2284cd55c59d6a586116d079ddf4c5fef | Triage

Analysis

max time kernel
144s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 16:12

Sharing

Report Analysis Logs

General

Target

goodbyedpi-0.2.3rc1/1_russia_blacklist.cmd
Size

274B
MD5

76763259e528cd27e998fb4c665c2b78
SHA1

f2b6e15dca04c54ace2aefc4bc72656dc7550cab
SHA256

69c8b67fafbca446ce5302e97f9947191ecb84d2a51eae61d4955dc3e2147da0
SHA512

69d35fb64ab4cee901b7ecc9baac437cd4dd5e3feb5b006a0fa8c3d52fce8ac9eea5ee68a6dcea01f5386966ac135e85bfba8fc8eecec5d8c70212e795d0dd76

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 5116	2200	cmd.exe	85
PID 2200 wrote to memory of 5116	2200	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.3rc1\1_russia_blacklist.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.3rc1\x86_64\goodbyedpi.exe
  goodbyedpi.exe -9 --blacklist ..\russia-blacklist.txt --blacklist ..\russia-youtube.txt
  2⤵
  PID:5116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5116-0-0x00007FF698170000-0x00007FF698190000-memory.dmp

Filesize
128KB

Download
memory/5116-1-0x0000000062800000-0x0000000062813000-memory.dmp

Filesize
76KB

Download
memory/5116-2-0x00007FF698170000-0x00007FF698190000-memory.dmp

Filesize
128KB

Download