Overview
overview
5Static
static
5обход...rt.dll
windows7-x64
1обход...rt.dll
windows10-2004-x64
1обход...64.sys
windows10-2004-x64
1обход...n1.dll
windows7-x64
5обход...n1.dll
windows10-2004-x64
5обход...ws.exe
windows7-x64
5обход...ws.exe
windows10-2004-x64
5обход...rd.bat
windows7-x64
5обход...rd.bat
windows10-2004-x64
5обход...al.bat
windows7-x64
5обход...al.bat
windows10-2004-x64
5обход...rd.bat
windows7-x64
1обход...rd.bat
windows10-2004-x64
1обход...al.bat
windows7-x64
1обход...al.bat
windows10-2004-x64
1обход...rd.bat
windows7-x64
1обход...rd.bat
windows10-2004-x64
1обход...ve.bat
windows7-x64
1обход...ve.bat
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 15:39
Behavioral task
behavioral1
Sample
обходик — копия/bin/WinDivert.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
обходик — копия/bin/WinDivert.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
обходик — копия/bin/WinDivert64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
обходик — копия/bin/cygwin1.dll
Resource
win7-20241023-en
Behavioral task
behavioral5
Sample
обходик — копия/bin/cygwin1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
обходик — копия/bin/winws.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
обходик — копия/bin/winws.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
обходик — копия/discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
обходик — копия/discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
обходик — копия/general.bat
Resource
win7-20241010-en
Behavioral task
behavioral11
Sample
обходик — копия/general.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
обходик — копия/service_discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
обходик — копия/service_discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
обходик — копия/service_general.bat
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
обходик — копия/service_general.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
обходик — копия/service_goodbye_discord.bat
Resource
win7-20240708-en
Behavioral task
behavioral17
Sample
обходик — копия/service_goodbye_discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
обходик — копия/service_remove.bat
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
обходик — копия/service_remove.bat
Resource
win10v2004-20241007-en
General
-
Target
обходик — копия/service_general.bat
-
Size
1KB
-
MD5
cb56dd3e71d70b3c3bc7cbe0675800ba
-
SHA1
289fb37d8906ca2245087fd6be78f4890df8da1a
-
SHA256
5a72a39607fbeb6542b71a59ff14ab7009800fa65119c4b4fb65d296934cbd94
-
SHA512
b586ecef1dafe6d2bad4605638d6e5ffbbe4800cb3533a721b62776a15fce58ad2794ae1efc75986a45005d068c398916baef2d8c18d801dcce9c0a58f717472
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1320 wrote to memory of 2460 1320 cmd.exe 32 PID 1320 wrote to memory of 2460 1320 cmd.exe 32 PID 1320 wrote to memory of 2460 1320 cmd.exe 32