2b071652ac3988a702dd2db58cda4c822ac1bd50043ad9fd44a57adadf0f4b8c | Triage

Analysis

max time kernel
105s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 05:08

Sharing

Report Analysis Logs

General

Target

goodbyedpi-0.2.2/1_russia_blacklist_dnsredir.cmd
Size

327B
MD5

f73c24aa2a64a897d88fee8787a48847
SHA1

96b91f1ea3322111617a52dfff5bbf7e5f2ebbe2
SHA256

cebffbb31125a1ac8abd68012bb413bac6da56258f0d4fa95dcb2f23e94b4779
SHA512

2b2bc84c284a86769e0a703f5548b463f70aedbfce2f05421d630bfbeeb12d67991c01f91184e45ed5e5681d45aeb209798f459ed68a776c77976ffaa44724b5

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 3936	5060	cmd.exe	88
PID 5060 wrote to memory of 3936	5060	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\1_russia_blacklist_dnsredir.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.2\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253 --blacklist ..\russia-blacklist.txt
  2⤵
  PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3936-1-0x0000000062800000-0x000000006280D000-memory.dmp

Filesize
52KB

Download
memory/3936-0-0x00007FF711060000-0x00007FF71107B000-memory.dmp

Filesize
108KB

Download
memory/3936-2-0x00007FF711060000-0x00007FF71107B000-memory.dmp

Filesize
108KB

Download