Overview
overview
6Static
static
3docsis_cfg...54.exe
windows7-x64
3docsis_cfg...54.exe
windows10-2004-x64
3Tality54.exe
windows7-x64
3Tality54.exe
windows10-2004-x64
3docsis_cfg...bs.url
windows7-x64
6docsis_cfg...bs.url
windows10-2004-x64
3docsis_cfg....7.dll
windows7-x64
3docsis_cfg....7.dll
windows10-2004-x64
3docsis_cfg...n1.dll
windows7-x64
3docsis_cfg...n1.dll
windows10-2004-x64
3docsis_cfg...t.html
windows7-x64
3docsis_cfg...t.html
windows10-2004-x64
3docsis_cfg...s.html
windows7-x64
3docsis_cfg...s.html
windows10-2004-x64
3docsis_cfg...x.html
windows7-x64
3docsis_cfg...x.html
windows10-2004-x64
3docsis_cfg...is.bat
windows7-x64
1docsis_cfg...is.bat
windows10-2004-x64
3docsis_cfg...is.exe
windows7-x64
1docsis_cfg...is.exe
windows10-2004-x64
3docsis_cfg...is.url
windows7-x64
6docsis_cfg...is.url
windows10-2004-x64
3docsis_cfg...fg.exe
windows7-x64
3docsis_cfg...fg.exe
windows10-2004-x64
3snmp/mibs/...mt.vbs
windows7-x64
1snmp/mibs/...mt.vbs
windows10-2004-x64
1snmp/mibs/cap.vbs
windows7-x64
1snmp/mibs/cap.vbs
windows10-2004-x64
1snmp/mibs/...IB.vbs
windows7-x64
1snmp/mibs/...IB.vbs
windows10-2004-x64
1snmp/mibs/...IB.vbs
windows7-x64
1snmp/mibs/...IB.vbs
windows10-2004-x64
1Analysis
-
max time kernel
95s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 05:16 UTC
Static task
static1
Behavioral task
behavioral1
Sample
docsis_cfg2.0.7/Tality54.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
docsis_cfg2.0.7/Tality54.exe
Resource
win10v2004-20240910-en
Behavioral task
behavioral3
Sample
Tality54.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Tality54.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
docsis_cfg2.0.7/cablelabs.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
docsis_cfg2.0.7/cablelabs.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
docsis_cfg2.0.7/cygcrypto-0.9.7.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
docsis_cfg2.0.7/cygcrypto-0.9.7.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
docsis_cfg2.0.7/cygwin1.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
docsis_cfg2.0.7/cygwin1.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
docsis_cfg2.0.7/doc/config-format.html
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
docsis_cfg2.0.7/doc/config-format.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
docsis_cfg2.0.7/doc/config-settings.html
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
docsis_cfg2.0.7/doc/config-settings.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
docsis_cfg2.0.7/doc/index.html
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
docsis_cfg2.0.7/doc/index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
docsis_cfg2.0.7/docsis.bat
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
docsis_cfg2.0.7/docsis.bat
Resource
win10v2004-20240910-en
Behavioral task
behavioral19
Sample
docsis_cfg2.0.7/docsis.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
docsis_cfg2.0.7/docsis.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
docsis_cfg2.0.7/docsis.url
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
docsis_cfg2.0.7/docsis.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
docsis_cfg2.0.7/docsis_cfg.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
docsis_cfg2.0.7/docsis_cfg.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
snmp/mibs/brcm-80211-mgmt.vbs
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
snmp/mibs/brcm-80211-mgmt.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
snmp/mibs/cap.vbs
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
snmp/mibs/cap.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
snmp/mibs/ietf/AGGREGATE-MIB.vbs
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
snmp/mibs/ietf/AGGREGATE-MIB.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
snmp/mibs/ietf/DISMAN-EVENT-MIB.vbs
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
snmp/mibs/ietf/DISMAN-EVENT-MIB.vbs
Resource
win10v2004-20240802-en
General
-
Target
docsis_cfg2.0.7/docsis.exe
-
Size
1.0MB
-
MD5
6879487a6f3ca7785900f568005620f7
-
SHA1
265714be556c9beac124333de4de5dd0149a029d
-
SHA256
0a53c444849a45119feb7600ef6b5712cf768ed976e3af2a64a3f525bd79c15e
-
SHA512
ed61add3f5f1ca63ea9e8c0564b2fefbf2cb2137979579d90d8ebed23cf4713cd675326ebca91ae501dc22294ecae123cd15bc882def949ccb4b462b232074d3
-
SSDEEP
24576:yHRUuF2BbUaIMPm++0/2XpfSgvO28xRv4upOgSxwAy1H:yP2hul0/2xh8xRv4upOxwAy1H
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language docsis.exe
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request68.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request98.117.19.2.in-addr.arpaIN PTRResponse98.117.19.2.in-addr.arpaIN PTRa2-19-117-98deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
68.159.190.20.in-addr.arpa
-
141 B 278 B 2 2
DNS Request
97.17.167.52.in-addr.arpa
DNS Request
98.117.19.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
56.163.245.4.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
142 B 157 B 2 1
DNS Request
13.86.106.20.in-addr.arpa
DNS Request
13.86.106.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
48.229.111.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa