Analysis
-
max time kernel
478s -
max time network
480s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-01-2025 11:39
General
-
Target
dogecoin-1.14.9-win32/dogecoin-qt.exe
-
Size
34.1MB
-
MD5
f421c6d2c8e4a07d7be1a13a4cbe6c82
-
SHA1
6f25ceaeeaf69d7dd662f39c46bcb4470cac69c6
-
SHA256
651f67cb96ed59fa41171741443710eb47a17d6173a925ad57a4f142bf50842a
-
SHA512
d99873cceb05d3430ebe4235298e8649c20c13977e230bcd7bca92dd68ffde5a55b24ce241ea92879b005117414adbd18149a7984089b6ad3b0e5e2a3fc8889f
-
SSDEEP
393216:HPvtaqFj3oP1L1d00XqDtb4knbfRVBhHjcF7X+lx+adk5j4xbRVeawa9AV88NrbQ:HPvtaq3oP15chHWX+v+drlTMx
Malware Config
Extracted
aresloader
http://127.0.0.1:22555
Signatures
-
AresLoader
AresLoader is a loader and downloader written in C++.
-
Aresloader family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dogecoin-1.14.9-win32\dogecoin-qt.exe"C:\Users\Admin\AppData\Local\Temp\dogecoin-1.14.9-win32\dogecoin-qt.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16.0MB
MD57cb7814bdeaa362268c9c5732a39d8db
SHA11d39fb869ac234a3d2fdf39bced7be91075e1969
SHA256680e328c73a0065fd361fc94ad14032569346d043ed9b021bf56fad17fb1f062
SHA512a6d7d7429473f0846af240b1ab4456af96eda33c7950720b023e71f92ce4ae3b03de7894a0414f1c8e5eb53f629b07ea33a8400be4112c875357abd8344e1c89
-
Filesize
16.0MB
MD5a196131b237710791bc7b25b1c8d41db
SHA1849515d8b8ccdee1509a537f340ab301392f9af8
SHA25646b376f755547a462122a188fd372af7c51d4e71d5ba8d39782ded1797dcda88
SHA51225f15fc5c89a4914f192ab69ba20ee6fd0626bba3ac4b97b7f498d3cf6b347dc168caabd1f03b18b39070bedc615a053991e3e4e7f363ec9ee8af2d23c0f9c22
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
1024KB
MD596dcfe89f85be86e57794c5b9d28751d
SHA1321246c0cece2a0e1e4b093628c225cceea23d9d
SHA256a455f606571694fb3a324eafe2f1b1863cd8a81e67ee4b83f0d3fc7a7d76da8b
SHA512097221fbb8d4dca5ae3fd90b092e9b588001611fa4a84ddb9e37469f4f4ae95447ee8106d5c8a5ea5d71560907407c65ab315e19169d76876f78369064dd5a08
-
Filesize
1024KB
MD5731a2e79744bde541e2d0809f2bd0339
SHA1ce809f144262aace667ffb34e4c280441cdae3aa
SHA256682a82cc1c6b8e82111fac2eb443668e7679dc6bf61863266b66e9f393b0f3d4
SHA512f7a84ea46ddd9df02a09e83cbdaf62b58e8821cb31aea9e3f14588f8e8142c911924f6ad74c3df4bc6ca5a8095dbaa2910bb60b96721caef9891545c18aab8fa
-
Filesize
1024KB
MD5dc9686cdc12ce8b534a84f6d72131a2d
SHA14156ba55e5c9ada71d9a7d35530ac3936e07c3dc
SHA2569685c9953235923ebc3a4a27a2773cd282abed70f5d895734b52a40b7fec468e
SHA512ecf347bf29683766cc9fc70fb4064e077e2f5613f49209a784380b06f837506daa2ac06024b447916d5a4924cd503d45562b8f486fa582e2f2bc82790dae6782
-
Filesize
1024KB
MD53938f3001762aee4ecca99eadf746dd7
SHA110e557e85ad182d350ef560a3395f5a0b8de8c73
SHA256d2bf3dd2ef9999c65394cc7ad7a09bf16bb7e9174e1b11fdccd21285d21c23be
SHA5129154090e2e8b8bdbc582b773720f58f495d444471590f0da14353cbcb49aa1bc6d736b3a0f902a003feed6373a8e7f22c5ce1ddccea5399db6ed3c15feec448b
-
Filesize
1024KB
MD59bd44fab07d2819a8831533817e270aa
SHA1ec901905b5d582d89fd5edfbf4ddde0f93dd99bf
SHA25643866262aa5d832100d03b2f267379ed4a3b303288c623eff27c3dab0d1348d3
SHA5128e04da673673dc99815c2f6c81c87cadda58af1be4a3cb63be7d78ab80ef966b5e709e1c3f16797444e4bdceb37f1c56b8aa97e4cfc9273bc9d35323882456b7
-
Filesize
1024KB
MD5c51e119e9b3de39afcec1295e36f8143
SHA12714f5ae5035d30a829d2e1b8101c9f9ff55e1b5
SHA256cf8e1055f5b20373c5be84bef57735e32ccdfe80475c72786c37805e3c6eb504
SHA512992e87cb009ea3fb66fd392e794a71bd6f9986c610eae839d5c1441bdedcbdb880ec271f69d7505e2bd223e0e1e361dd8d29779c13848e19a3a86fe09466cc9b
-
Filesize
1024KB
MD5d137a538f5fe0c6fd3f42af18c3560be
SHA18b7376c33c0d61494127d56008477e4f7cea5a0a
SHA25692bd724e232cd8f68da078c4903778e2ae5e0e631ec372ac2cd9d39fd7e91a76
SHA51202a776ffce6468f8df2647fdc861f413fc9cbb31d496a651ef0b7a2009f166777e86c8e459cd29e9af164ab049ea2c2d3a706524129f510d5491635432b12ce1
-
Filesize
1024KB
MD594f0233f5e5541a8933daf1a1e94d4e8
SHA1732eb816fc8582190611097acb69dde6175f9270
SHA25681ae9ed2abe8fade24e708b6e0f36043c246693f7dc956dc4ef141264f42b8ed
SHA512da71e789483764a51c1544fe6ea5c239a99a5182b55706e8d17f78ebadf51bcb0f29e1d628a4f1002941665860426a639e4c88f59f6b45cd0144409217fac007
-
Filesize
1024KB
MD55929428a06694d97058953608bf52ece
SHA14c609f9cf5b4747e33eb644f36717748661cfeb6
SHA256ccfc016b69647eb17f50d68e03631e6250a1f55cd3181dbe2d791b1a02b838f9
SHA51261132a308735f5cdbaa0500fb62223e52533f6e0138df38c4522eb7f634f2ddfdfbe20a36a1ebb3c9546f5261243c6e95c0b61ee8682570ae26f3b0c44b50c65
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
34.2MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB