2b071652ac3988a702dd2db58cda4c822ac1bd50043ad9fd44a57adadf0f4b8c | Triage

Analysis

max time kernel
107s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 05:08

Sharing

Report Analysis Logs

General

Target

goodbyedpi-0.2.2/2_any_country_dnsredir.cmd
Size

291B
MD5

48de91946fd423515b182a622842adc5
SHA1

4519a0bc87a0e0838f003d3e4e4904d5721abad7
SHA256

a7762f252e434134245adee7398eabc7b96e4e83ee408ce63cc3f92b942c4b6b
SHA512

43ef99d5f0ed8725cfad206d6d3bd0d393258872882f3c2fd8f974703dfb418652f9f1adae5b6e9ab769cf9a46192655c795c4ebc0adf4cd6a1b4e7cd20db745

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 1688	5524	cmd.exe	87
PID 5524 wrote to memory of 1688	5524	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\2_any_country_dnsredir.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253
  2⤵
  PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-0-0x00007FF7147E0000-0x00007FF7147FB000-memory.dmp

Filesize
108KB

Download
memory/1688-1-0x0000000062800000-0x000000006280D000-memory.dmp

Filesize
52KB

Download
memory/1688-2-0x00007FF7147E0000-0x00007FF7147FB000-memory.dmp

Filesize
108KB

Download