0cad6aa35e8bc5c0148fd17b3ebb3477175520cd6bf32fcde9ab19ca03425a29

Analysis

max time kernel
60s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnDDoS.exe
Size

522KB
MD5

d027869ca68b6df09e2fe721a1acb994
SHA1

d50ea5e2ab1b5b9362f010248328b19a5a395dfe
SHA256

0cad6aa35e8bc5c0148fd17b3ebb3477175520cd6bf32fcde9ab19ca03425a29
SHA512

8890d7ac227a7a8368a71a84797916521886d58de69c78ecccea82ec357f33930b28ac215905ee926b2d9f93808ff72d37cd600511eab1c4e16b9140891601a5
SSDEEP

12288:cCga6BJor4hQMdhwS9XVCga6BJor4hQMdhwS9Xm:cCga6BJe4q6JlCga6BJe4q6J2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnDDoS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 25 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4000	cmd.exe
4112	cmd.exe
2376	cmd.exe
2284	cmd.exe
3996	PING.EXE
4312	PING.EXE
1220	PING.EXE
1752	cmd.exe
3616	PING.EXE
1576	PING.EXE
3856	cmd.exe
1516	cmd.exe
3160	cmd.exe
4008	PING.EXE
3756	cmd.exe
3940	cmd.exe
1856	cmd.exe
4656	PING.EXE
3648	PING.EXE
224	PING.EXE
4440	PING.EXE
456	PING.EXE
4336	cmd.exe
4900	cmd.exe
3728	PING.EXE

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
456	PING.EXE
4656	PING.EXE
3648	PING.EXE
4312	PING.EXE
224	PING.EXE
4008	PING.EXE
4440	PING.EXE
3616	PING.EXE
1220	PING.EXE
1576	PING.EXE
3996	PING.EXE
3728	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4000	5020	AnDDoS.exe	95
PID 5020 wrote to memory of 4000	5020	AnDDoS.exe	95
PID 5020 wrote to memory of 4000	5020	AnDDoS.exe	95
PID 4000 wrote to memory of 4656	4000	cmd.exe	97
PID 4000 wrote to memory of 4656	4000	cmd.exe	97
PID 4000 wrote to memory of 4656	4000	cmd.exe	97
PID 5020 wrote to memory of 4112	5020	AnDDoS.exe	98
PID 5020 wrote to memory of 4112	5020	AnDDoS.exe	98
PID 5020 wrote to memory of 4112	5020	AnDDoS.exe	98
PID 4112 wrote to memory of 3648	4112	cmd.exe	100
PID 4112 wrote to memory of 3648	4112	cmd.exe	100
PID 4112 wrote to memory of 3648	4112	cmd.exe	100
PID 5020 wrote to memory of 3160	5020	AnDDoS.exe	104
PID 5020 wrote to memory of 3160	5020	AnDDoS.exe	104
PID 5020 wrote to memory of 3160	5020	AnDDoS.exe	104
PID 3160 wrote to memory of 4312	3160	cmd.exe	106
PID 3160 wrote to memory of 4312	3160	cmd.exe	106
PID 3160 wrote to memory of 4312	3160	cmd.exe	106
PID 5020 wrote to memory of 4336	5020	AnDDoS.exe	107
PID 5020 wrote to memory of 4336	5020	AnDDoS.exe	107
PID 5020 wrote to memory of 4336	5020	AnDDoS.exe	107
PID 4336 wrote to memory of 1220	4336	cmd.exe	109
PID 4336 wrote to memory of 1220	4336	cmd.exe	109
PID 4336 wrote to memory of 1220	4336	cmd.exe	109
PID 5020 wrote to memory of 3940	5020	AnDDoS.exe	110
PID 5020 wrote to memory of 3940	5020	AnDDoS.exe	110
PID 5020 wrote to memory of 3940	5020	AnDDoS.exe	110
PID 3940 wrote to memory of 224	3940	cmd.exe	112
PID 3940 wrote to memory of 224	3940	cmd.exe	112
PID 3940 wrote to memory of 224	3940	cmd.exe	112
PID 5020 wrote to memory of 2376	5020	AnDDoS.exe	113
PID 5020 wrote to memory of 2376	5020	AnDDoS.exe	113
PID 5020 wrote to memory of 2376	5020	AnDDoS.exe	113
PID 2376 wrote to memory of 4008	2376	cmd.exe	115
PID 2376 wrote to memory of 4008	2376	cmd.exe	115
PID 2376 wrote to memory of 4008	2376	cmd.exe	115
PID 5020 wrote to memory of 1752	5020	AnDDoS.exe	116
PID 5020 wrote to memory of 1752	5020	AnDDoS.exe	116
PID 5020 wrote to memory of 1752	5020	AnDDoS.exe	116
PID 1752 wrote to memory of 4440	1752	cmd.exe	118
PID 1752 wrote to memory of 4440	1752	cmd.exe	118
PID 1752 wrote to memory of 4440	1752	cmd.exe	118
PID 5020 wrote to memory of 1856	5020	AnDDoS.exe	119
PID 5020 wrote to memory of 1856	5020	AnDDoS.exe	119
PID 5020 wrote to memory of 1856	5020	AnDDoS.exe	119
PID 1856 wrote to memory of 3616	1856	cmd.exe	121
PID 1856 wrote to memory of 3616	1856	cmd.exe	121
PID 1856 wrote to memory of 3616	1856	cmd.exe	121
PID 5020 wrote to memory of 2284	5020	AnDDoS.exe	122
PID 5020 wrote to memory of 2284	5020	AnDDoS.exe	122
PID 5020 wrote to memory of 2284	5020	AnDDoS.exe	122
PID 2284 wrote to memory of 1576	2284	cmd.exe	124
PID 2284 wrote to memory of 1576	2284	cmd.exe	124
PID 2284 wrote to memory of 1576	2284	cmd.exe	124
PID 5020 wrote to memory of 3756	5020	AnDDoS.exe	125
PID 5020 wrote to memory of 3756	5020	AnDDoS.exe	125
PID 5020 wrote to memory of 3756	5020	AnDDoS.exe	125
PID 5020 wrote to memory of 4900	5020	AnDDoS.exe	127
PID 5020 wrote to memory of 4900	5020	AnDDoS.exe	127
PID 5020 wrote to memory of 4900	5020	AnDDoS.exe	127
PID 3756 wrote to memory of 456	3756	cmd.exe	129
PID 3756 wrote to memory of 456	3756	cmd.exe	129
PID 3756 wrote to memory of 456	3756	cmd.exe	129
PID 4900 wrote to memory of 3996	4900	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\AnDDoS.exe
"C:\Users\Admin\AppData\Local\Temp\AnDDoS.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3856
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5020-0-0x000000007444E000-0x000000007444F000-memory.dmp

Filesize
4KB

Download
memory/5020-1-0x0000000000DD0000-0x0000000000E5A000-memory.dmp

Filesize
552KB

Download
memory/5020-2-0x0000000005830000-0x00000000058CC000-memory.dmp

Filesize
624KB

Download
memory/5020-3-0x0000000005E80000-0x0000000006424000-memory.dmp

Filesize
5.6MB

Download
memory/5020-4-0x0000000005970000-0x0000000005A02000-memory.dmp

Filesize
584KB

Download
memory/5020-7-0x0000000005A10000-0x0000000005A66000-memory.dmp

Filesize
344KB

Download
memory/5020-6-0x00000000058F0000-0x00000000058FA000-memory.dmp

Filesize
40KB

Download
memory/5020-5-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/5020-8-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/5020-9-0x000000007444E000-0x000000007444F000-memory.dmp

Filesize
4KB

Download
memory/5020-10-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/5020-11-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads