2b071652ac3988a702dd2db58cda4c822ac1bd50043ad9fd44a57adadf0f4b8c | Triage

Analysis

max time kernel
104s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 05:08

Sharing

Report Analysis Logs

General

Target

goodbyedpi-0.2.2/1_russia_blacklist.cmd
Size

240B
MD5

10812f31ef70edc954eaf63650336212
SHA1

1daef3d49e40067a1d77bd18c0c87e557b0aeb40
SHA256

e155b6eadd37942f9bfc8d6d00aca4f518a056fc81ac8666a6532ba90f77fd93
SHA512

c749e95a7fbf7ca55656da08259e26924d89c129f1ed6a2f435bc26393f3b1bcc90613abf71e1753d6e77591622a7494835889dc1cb198fb3aed19ff97bd2932

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 4328	1272	cmd.exe	85
PID 1272 wrote to memory of 4328	1272	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\1_russia_blacklist.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 --blacklist ..\russia-blacklist.txt
  2⤵
  PID:4328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4328-0-0x00007FF7216A0000-0x00007FF7216BB000-memory.dmp

Filesize
108KB

Download
memory/4328-1-0x0000000062800000-0x000000006280D000-memory.dmp

Filesize
52KB

Download
memory/4328-2-0x00007FF7216A0000-0x00007FF7216BB000-memory.dmp

Filesize
108KB

Download