Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-01-2025 11:56
General
-
Target
dogecoin-1.14.9-win32/dogecoin-qt.exe
-
Size
34.1MB
-
MD5
f421c6d2c8e4a07d7be1a13a4cbe6c82
-
SHA1
6f25ceaeeaf69d7dd662f39c46bcb4470cac69c6
-
SHA256
651f67cb96ed59fa41171741443710eb47a17d6173a925ad57a4f142bf50842a
-
SHA512
d99873cceb05d3430ebe4235298e8649c20c13977e230bcd7bca92dd68ffde5a55b24ce241ea92879b005117414adbd18149a7984089b6ad3b0e5e2a3fc8889f
-
SSDEEP
393216:HPvtaqFj3oP1L1d00XqDtb4knbfRVBhHjcF7X+lx+adk5j4xbRVeawa9AV88NrbQ:HPvtaq3oP15chHWX+v+drlTMx
Score
10/10
Malware Config
Extracted
Family
aresloader
C2
http://127.0.0.1:22555
Signatures
-
AresLoader
AresLoader is a loader and downloader written in C++.
-
Aresloader family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dogecoin-1.14.9-win32\dogecoin-qt.exe"C:\Users\Admin\AppData\Local\Temp\dogecoin-1.14.9-win32\dogecoin-qt.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB