Analysis
-
max time kernel
296s -
max time network
300s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-01-2025 11:39
General
-
Target
dogecoin-1.14.9-win32/daemon/dogecoind.exe
-
Size
10.8MB
-
MD5
bd105bf449a53559a1f03bc3cee01201
-
SHA1
beb01382e4f15f3ba0073816dcefdec05206bf6a
-
SHA256
a2ea0f21d7b418869651c791d8973c983cca3964aee225d03fbf9d72a2a18b31
-
SHA512
8d8605bfa802ea1bc491e1a9a63b7d01ac73f45b9e29777aacdc0d82fa85d7a6100b53b3ab6fe83c110444ef7e391e6f9b502b3c2f78da96918156b93135a060
-
SSDEEP
196608:6rGbOYFXKiN8lytROoQIv+vaMiYYkO1KNT7muZemqBFrKUr8920vqb8i9lpmP5sM:f1XKAQ8CzKuZenbZLbXuHSb4AjbfMkpq
Malware Config
Extracted
aresloader
http://127.0.0.1:22555
Signatures
-
AresLoader
AresLoader is a loader and downloader written in C++.
-
Aresloader family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dogecoin-1.14.9-win32\daemon\dogecoind.exe"C:\Users\Admin\AppData\Local\Temp\dogecoin-1.14.9-win32\daemon\dogecoind.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16.0MB
MD5f8a9d4cf20f20a50c812bd03c093e29a
SHA15a1f4a7c9fb731b6eee0845f8537e1ba1ff78f01
SHA256da7bb5422e1a8562c612dc641b84271989a5a49139bcf79b76be2a8e9fb49dab
SHA512c5b6666d4ee0d7b9755752c43990adf0c1ec21d4a0d03a7da5feaad8840694bad7573212661e7c1735cf16baa024a06ca1ec50dcf5f822fef45edb050c68a27f
-
Filesize
16.0MB
MD50655a777c0e7fced17e04569506a1055
SHA151e3325e2f0b9989508e0a04234c79509ef23acb
SHA2561edffbe81ea8943814b5193ea15a6abaeb67360a9a1e441e31dcf8760c60bc1e
SHA5126547936b2fc9ba77d8b2a444ce9b39738e0e82710e9b579dd4bd026d81bc7a82bf282c7ed69202fe34773d0b513697254277f3b5fa8912c0cd7110107bfc4c36
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
1024KB
MD5dd41aab55cd110a48e2c477e5bdfd861
SHA1b632e1c2d5364789644cf0e7221688fed6bf93f1
SHA2565f8065237265a8997a6141cd3538b3740dfc56f6034d5ddf57d995c10adcc954
SHA5127170bad9aa0f662a9244db8cb85bddd1790ca50888db7acd065bf16fa5a88ce2a994d7b20d1af44c93690cc1f5cf44ffb53eec887dee76d91b68dde9a8febdab
-
Filesize
1024KB
MD53938f3001762aee4ecca99eadf746dd7
SHA110e557e85ad182d350ef560a3395f5a0b8de8c73
SHA256d2bf3dd2ef9999c65394cc7ad7a09bf16bb7e9174e1b11fdccd21285d21c23be
SHA5129154090e2e8b8bdbc582b773720f58f495d444471590f0da14353cbcb49aa1bc6d736b3a0f902a003feed6373a8e7f22c5ce1ddccea5399db6ed3c15feec448b
-
Filesize
1024KB
MD5928dadf5f47d70ddacf680c2a0b5d72a
SHA174bbfe46839bb0d9b5c257b6eb6964b6931de1a0
SHA25678c75c2ee889c84a2bd2dbfc0fe2527d982c00e9d69574ff436c84a44f367f4e
SHA512c5b0175ee92cf536a0999f4755bb4ad06dd55d8b95c4c2ab90d3b31e3824c1d01bc84c9142f287597dfd4dd86693adf23057f30595cdaddcfefceb6c2f6c0486
-
Filesize
1024KB
MD594f0233f5e5541a8933daf1a1e94d4e8
SHA1732eb816fc8582190611097acb69dde6175f9270
SHA25681ae9ed2abe8fade24e708b6e0f36043c246693f7dc956dc4ef141264f42b8ed
SHA512da71e789483764a51c1544fe6ea5c239a99a5182b55706e8d17f78ebadf51bcb0f29e1d628a4f1002941665860426a639e4c88f59f6b45cd0144409217fac007
-
Filesize
1024KB
MD5b3b3f29aeed3c76a267a446f99a7a23c
SHA17360ca158be575095dae94d2474d5b2ed7689b77
SHA256c7b3853ada6a75373a8d95105fd1832a63839119b110a072362f44f22adf3755
SHA512a74d0fe75cb98d8ff94ee0bf01562273830d1ea592d856f3be74e5ff13b1354c50ba3befac209ceab10ce03f04172db00916cad8afdd6d6953a5e318c2ba293c
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB