Analysis
-
max time kernel
0s -
max time network
4s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 17:47
Static task
static1
Behavioral task
behavioral1
Sample
Doenerium Builder.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Doenerium Builder.exe
Resource
win10v2004-20240802-en
General
-
Target
Doenerium Builder.exe
-
Size
12.1MB
-
MD5
a89b5a734cced64ae3cc202bdfac8759
-
SHA1
81a4254491dd554a5113f63ad7849d93cc30d3d7
-
SHA256
fd111c335073ae9b9f33d1f3e348bcbc46dd0b90de333156c2dbbee62412374b
-
SHA512
68ac8b1e4739fb444f1ef055015455094a3c768c84e96279996a11a9e1a4e7ae2192acb862cd896844c01cbed24e3fc0868fa8891d4806a46e70e2e3e2175e73
-
SSDEEP
393216:0GV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:TYQZ2YwUlJn1QtIm28IKzo
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Doenerium Builder.exepid process 1008 Doenerium Builder.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Doenerium Builder.exedescription pid process target process PID 5004 wrote to memory of 1008 5004 Doenerium Builder.exe Doenerium Builder.exe PID 5004 wrote to memory of 1008 5004 Doenerium Builder.exe Doenerium Builder.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doenerium Builder.exe"C:\Users\Admin\AppData\Local\Temp\Doenerium Builder.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\Doenerium Builder.exe"C:\Users\Admin\AppData\Local\Temp\Doenerium Builder.exe"2⤵
- Loads dropped DLL
PID:1008
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576KB
MD573a609f2b67fc8b082ca9f718ed28d28
SHA104311cf540be805938d4d203ec7ec91a66dd849d
SHA25675428d7e5f741ff23768cd77267f4d080ccf07f36afc7553a2847474aefb96ed
SHA512955f985d8687d1b221d4a1217b9be51e740f6605fd9f9ceb766e25587aca194b5f517a5d9b24af780d32c637778ddc5f88484aa811cd658a1ba2a4c4e133e4bd
-
Filesize
1.1MB
MD5a9f5b06fae677c9eb5be8b37d5fb1cb9
SHA15c37b880a1479445dd583f85c58a8790584f595d
SHA2564e9e93fd6486571e1b5dce381fa536fb6c5593584d3330368ccd47ee6107bf52
SHA5125d7664716fa52f407d56771862262317ac7f4a03f31f209333c3eea7f1c8cf3d5dbafc1942122948d19208d023df220407014f47e57694e70480a878822b779a
-
Filesize
640KB
MD5f809fcfed5e6bf4010a78b34a285fcf6
SHA13931d95b361c2509901e04b1038381086bdbcef0
SHA256877af01b54cdc6b378c48f7682570cf18b5f4bbc510ef3950cabe41ed7754d8b
SHA5126e3935128bc3dbbc0b693f2d3c1f934556b13acc2d3f30bcae7cfad8634a98d5ae46b892cdd58146cc60cb290aaf8b684161f0b8e5b09869ebcf0e40bdeb27ab