0cad6aa35e8bc5c0148fd17b3ebb3477175520cd6bf32fcde9ab19ca03425a29

Analysis

max time kernel
59s
max time network
33s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2024, 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnDDoS.exe
Size

522KB
MD5

d027869ca68b6df09e2fe721a1acb994
SHA1

d50ea5e2ab1b5b9362f010248328b19a5a395dfe
SHA256

0cad6aa35e8bc5c0148fd17b3ebb3477175520cd6bf32fcde9ab19ca03425a29
SHA512

8890d7ac227a7a8368a71a84797916521886d58de69c78ecccea82ec357f33930b28ac215905ee926b2d9f93808ff72d37cd600511eab1c4e16b9140891601a5
SSDEEP

12288:cCga6BJor4hQMdhwS9XVCga6BJor4hQMdhwS9Xm:cCga6BJe4q6JlCga6BJe4q6J2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnDDoS.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
876	cmd.exe
4672	PING.EXE
1208	cmd.exe
2160	PING.EXE
848	PING.EXE
3612	cmd.exe
1668	PING.EXE
5112	cmd.exe
2164	PING.EXE
3020	PING.EXE
3788	cmd.exe
2256	PING.EXE
556	cmd.exe
2516	PING.EXE
4892	PING.EXE
4968	PING.EXE
3484	PING.EXE
1628	PING.EXE
4996	cmd.exe
4364	PING.EXE
3752	cmd.exe
4092	cmd.exe
2516	cmd.exe
3960	PING.EXE
4740	cmd.exe
3368	cmd.exe
4684	cmd.exe
3508	PING.EXE
4256	cmd.exe
1192	cmd.exe
3948	cmd.exe
4788	PING.EXE
3744	cmd.exe
4444	PING.EXE
2080	PING.EXE
3448	PING.EXE
3472	cmd.exe
3960	PING.EXE
2192	PING.EXE
3164	cmd.exe
4104	cmd.exe
2388	cmd.exe
2000	PING.EXE
2020	PING.EXE
2820	PING.EXE
3212	PING.EXE
3428	PING.EXE
4964	cmd.exe
4840	cmd.exe
3716	PING.EXE
4016	PING.EXE
1176	cmd.exe
4580	PING.EXE
4476	PING.EXE
4452	PING.EXE
2372	cmd.exe
2256	PING.EXE
3508	cmd.exe
1528	cmd.exe
3936	cmd.exe
1380	cmd.exe
4672	PING.EXE
2040	cmd.exe
1616	PING.EXE

Runs ping.exe 1 TTPs 42 IoCs

Remote System Discovery

T1018

pid	Process
2160	PING.EXE
848	PING.EXE
3448	PING.EXE
3772	PING.EXE
2192	PING.EXE
1616	PING.EXE
4452	PING.EXE
2080	PING.EXE
2164	PING.EXE
3716	PING.EXE
3020	PING.EXE
4476	PING.EXE
1104	PING.EXE
2256	PING.EXE
4672	PING.EXE
4968	PING.EXE
3428	PING.EXE
3960	PING.EXE
2000	PING.EXE
4672	PING.EXE
1520	PING.EXE
4016	PING.EXE
3984	PING.EXE
2932	PING.EXE
4444	PING.EXE
1000	PING.EXE
2820	PING.EXE
2516	PING.EXE
4112	PING.EXE
4788	PING.EXE
4580	PING.EXE
2020	PING.EXE
3508	PING.EXE
1668	PING.EXE
4892	PING.EXE
3484	PING.EXE
3960	PING.EXE
3212	PING.EXE
4364	PING.EXE
1628	PING.EXE
2256	PING.EXE
4216	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 3164	2672	AnDDoS.exe	82
PID 2672 wrote to memory of 3164	2672	AnDDoS.exe	82
PID 2672 wrote to memory of 3164	2672	AnDDoS.exe	82
PID 3164 wrote to memory of 3484	3164	cmd.exe	84
PID 3164 wrote to memory of 3484	3164	cmd.exe	84
PID 3164 wrote to memory of 3484	3164	cmd.exe	84
PID 2672 wrote to memory of 2208	2672	AnDDoS.exe	85
PID 2672 wrote to memory of 2208	2672	AnDDoS.exe	85
PID 2672 wrote to memory of 2208	2672	AnDDoS.exe	85
PID 2208 wrote to memory of 2256	2208	cmd.exe	87
PID 2208 wrote to memory of 2256	2208	cmd.exe	87
PID 2208 wrote to memory of 2256	2208	cmd.exe	87
PID 2672 wrote to memory of 236	2672	AnDDoS.exe	88
PID 2672 wrote to memory of 236	2672	AnDDoS.exe	88
PID 2672 wrote to memory of 236	2672	AnDDoS.exe	88
PID 236 wrote to memory of 1104	236	cmd.exe	90
PID 236 wrote to memory of 1104	236	cmd.exe	90
PID 236 wrote to memory of 1104	236	cmd.exe	90
PID 2672 wrote to memory of 1872	2672	AnDDoS.exe	91
PID 2672 wrote to memory of 1872	2672	AnDDoS.exe	91
PID 2672 wrote to memory of 1872	2672	AnDDoS.exe	91
PID 1872 wrote to memory of 2160	1872	cmd.exe	93
PID 1872 wrote to memory of 2160	1872	cmd.exe	93
PID 1872 wrote to memory of 2160	1872	cmd.exe	93
PID 2672 wrote to memory of 4964	2672	AnDDoS.exe	94
PID 2672 wrote to memory of 4964	2672	AnDDoS.exe	94
PID 2672 wrote to memory of 4964	2672	AnDDoS.exe	94
PID 4964 wrote to memory of 3960	4964	cmd.exe	96
PID 4964 wrote to memory of 3960	4964	cmd.exe	96
PID 4964 wrote to memory of 3960	4964	cmd.exe	96
PID 2672 wrote to memory of 4104	2672	AnDDoS.exe	97
PID 2672 wrote to memory of 4104	2672	AnDDoS.exe	97
PID 2672 wrote to memory of 4104	2672	AnDDoS.exe	97
PID 4104 wrote to memory of 4452	4104	cmd.exe	99
PID 4104 wrote to memory of 4452	4104	cmd.exe	99
PID 4104 wrote to memory of 4452	4104	cmd.exe	99
PID 2672 wrote to memory of 2388	2672	AnDDoS.exe	100
PID 2672 wrote to memory of 2388	2672	AnDDoS.exe	100
PID 2672 wrote to memory of 2388	2672	AnDDoS.exe	100
PID 2388 wrote to memory of 2000	2388	cmd.exe	102
PID 2388 wrote to memory of 2000	2388	cmd.exe	102
PID 2388 wrote to memory of 2000	2388	cmd.exe	102
PID 2672 wrote to memory of 4840	2672	AnDDoS.exe	103
PID 2672 wrote to memory of 4840	2672	AnDDoS.exe	103
PID 2672 wrote to memory of 4840	2672	AnDDoS.exe	103
PID 4840 wrote to memory of 2020	4840	cmd.exe	105
PID 4840 wrote to memory of 2020	4840	cmd.exe	105
PID 4840 wrote to memory of 2020	4840	cmd.exe	105
PID 2672 wrote to memory of 4684	2672	AnDDoS.exe	106
PID 2672 wrote to memory of 4684	2672	AnDDoS.exe	106
PID 2672 wrote to memory of 4684	2672	AnDDoS.exe	106
PID 4684 wrote to memory of 2080	4684	cmd.exe	108
PID 4684 wrote to memory of 2080	4684	cmd.exe	108
PID 4684 wrote to memory of 2080	4684	cmd.exe	108
PID 2672 wrote to memory of 3788	2672	AnDDoS.exe	109
PID 2672 wrote to memory of 3788	2672	AnDDoS.exe	109
PID 2672 wrote to memory of 3788	2672	AnDDoS.exe	109
PID 3788 wrote to memory of 4216	3788	cmd.exe	111
PID 3788 wrote to memory of 4216	3788	cmd.exe	111
PID 3788 wrote to memory of 4216	3788	cmd.exe	111
PID 2672 wrote to memory of 1380	2672	AnDDoS.exe	112
PID 2672 wrote to memory of 1380	2672	AnDDoS.exe	112
PID 2672 wrote to memory of 1380	2672	AnDDoS.exe	112
PID 1380 wrote to memory of 848	1380	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\AnDDoS.exe
"C:\Users\Admin\AppData\Local\Temp\AnDDoS.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs ping.exe
    PID:1104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs ping.exe
    PID:4216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  PID:3684
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3612
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4256
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5112
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  PID:4736
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4740
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - Runs ping.exe
    PID:1520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:556
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1192
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs ping.exe
    PID:3772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3936
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2372
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4628
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1972
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3368
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs ping.exe
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3948
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1176
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - Runs ping.exe
    PID:3984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3472
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3752
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  PID:2440
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:876
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - Runs ping.exe
    PID:2932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3508
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3744
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4092
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2040
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1640
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2516
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1208
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3192
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4996
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs ping.exe
    PID:1000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3172
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping https://bigrat.monster -t
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1528
- - C:\Windows\SysWOW64\PING.EXE
    ping https://bigrat.monster -t
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-0-0x00000000747EE000-0x00000000747EF000-memory.dmp

Filesize
4KB

Download
memory/2672-1-0x0000000000560000-0x00000000005EA000-memory.dmp

Filesize
552KB

Download
memory/2672-2-0x0000000004F40000-0x0000000004FDC000-memory.dmp

Filesize
624KB

Download
memory/2672-3-0x0000000005590000-0x0000000005B36000-memory.dmp

Filesize
5.6MB

Download
memory/2672-4-0x0000000005080000-0x0000000005112000-memory.dmp

Filesize
584KB

Download
memory/2672-5-0x0000000004FF0000-0x0000000004FFA000-memory.dmp

Filesize
40KB

Download
memory/2672-6-0x00000000747E0000-0x0000000074F91000-memory.dmp

Filesize
7.7MB

Download
memory/2672-7-0x0000000005210000-0x0000000005266000-memory.dmp

Filesize
344KB

Download
memory/2672-8-0x00000000747E0000-0x0000000074F91000-memory.dmp

Filesize
7.7MB

Download
memory/2672-9-0x00000000747EE000-0x00000000747EF000-memory.dmp

Filesize
4KB

Download
memory/2672-10-0x00000000747E0000-0x0000000074F91000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads