2b071652ac3988a702dd2db58cda4c822ac1bd50043ad9fd44a57adadf0f4b8c | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/03/2025, 05:08

Sharing

Report Analysis Logs

General

Target

goodbyedpi-0.2.2/1_russia_blacklist.cmd
Size

240B
MD5

10812f31ef70edc954eaf63650336212
SHA1

1daef3d49e40067a1d77bd18c0c87e557b0aeb40
SHA256

e155b6eadd37942f9bfc8d6d00aca4f518a056fc81ac8666a6532ba90f77fd93
SHA512

c749e95a7fbf7ca55656da08259e26924d89c129f1ed6a2f435bc26393f3b1bcc90613abf71e1753d6e77591622a7494835889dc1cb198fb3aed19ff97bd2932

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2876	2300	cmd.exe	31
PID 2300 wrote to memory of 2876	2300	cmd.exe	31
PID 2300 wrote to memory of 2876	2300	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\1_russia_blacklist.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 --blacklist ..\russia-blacklist.txt
  2⤵
  PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2876-0-0x000000013FC90000-0x000000013FCAB000-memory.dmp

Filesize
108KB

Download
memory/2876-1-0x0000000062800000-0x000000006280D000-memory.dmp

Filesize
52KB

Download
memory/2876-4-0x000000013FC90000-0x000000013FCAB000-memory.dmp

Filesize
108KB

Download