Overview

overview

3

Static

static

1

infected.zip

windows10-2004-x64

1

.env

windows10-2004-x64

3

afk_data.json

windows10-2004-x64

3

auto_messages.json

windows10-2004-x64

3

auto_responses.json

windows10-2004-x64

3

cogs/admin.py

windows10-2004-x64

3

cogs/afk.py

windows10-2004-x64

3

cogs/auto_...s.json

windows10-2004-x64

3

cogs/auto_...s.json

windows10-2004-x64

3

cogs/automessage.py

windows10-2004-x64

3

cogs/autoresponder.py

windows10-2004-x64

3

cogs/crypto.py

windows10-2004-x64

3

cogs/dump.py

windows10-2004-x64

3

cogs/fun.py

windows10-2004-x64

3

cogs/hentai.py

windows10-2004-x64

3

cogs/image.py

windows10-2004-x64

3

cogs/info.py

windows10-2004-x64

3

cogs/nuke.py

windows10-2004-x64

3

cogs/statu...tor.py

windows10-2004-x64

3

cogs/utiltity.py

windows10-2004-x64

3

cogs/vc.py

windows10-2004-x64

3

infreq.txt

windows10-2004-x64

1

main.py

windows10-2004-x64

3

readme.txt

windows10-2004-x64

1

status.txt

windows10-2004-x64

1

Analysis

  • max time kernel
    432s
  • max time network
    1155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 03:11 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    .env

  • Size

    36B

  • MD5

    65031d96a91b3579bae7b8da384d1000

  • SHA1

    42bfd72cb37796aef204f60f50a2f3aa5b55a6fe

  • SHA256

    7f361ef6bddefde1fe9c552ecae97b4cf020da64e76c161f0c674a5b1bc418ea

  • SHA512

    e083ab51f75cf7a22c5e487cdaa365e2a4677c6e4be5948d06086dce73dcc9f9de63ad042199f9e29268075e65263ed49cc4382384a7d4f291d30e8a7741a973

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\.env
    1⤵
    • Modifies registry class
    PID:4748
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2644

Network

  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    72.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    24.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    24.173.189.20.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    72.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    72.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    24.173.189.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    24.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.