Overview

overview

9

Static

static

3

ndvy_ddoser.exe

windows10-2004-x64

9

ndvy_ddoser.exe

windows11-ltsc_2024-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    577s
  • max time network
    732s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/06/2026, 05:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ndvy_ddoser.exe
  • Size 8.3MB
  • Sample260626-galrmsgz8y
  • SHA256 9e46dce5e13a19569eb00dfead67a26954d4b2d9a7736b476f7dd1745f8d4daf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discovery

Malware Config

Signatures

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Loads dropped DLL 18 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • GoLang User-Agent 64 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ndvy_ddoser.exe
    "C:\Users\Admin\AppData\Local\Temp\ndvy_ddoser.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Users\Admin\AppData\Local\Temp\ndvy_ddoser.exe
      C:\Users\Admin\AppData\Local\Temp\ndvy_ddoser.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:4256
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          3⤵
            PID:1468
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
          PID:5788
        • C:\Windows\System32\oobe\UserOOBEBroker.exe
          C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
          1⤵
          • Drops file in Windows directory
          PID:3824
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
          C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
          1⤵
          • System Location Discovery: System Language Discovery
          PID:1160

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              81d243bd2c585b0f4821__mypyc.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\81d243bd2c585b0f4821__mypyc.pyd
              • Size 214KB
              • SHA256 52056f4b964f1bc0419064a374a32e56ef85ccb161166971d26f46a7490bd238
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\_bz2.pyd
              • Size 83KB
              • SHA256 324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\_ctypes.pyd
              • Size 122KB
              • SHA256 8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _hashlib.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\_hashlib.pyd
              • Size 64KB
              • SHA256 f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\_lzma.pyd
              • Size 156KB
              • SHA256 6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _queue.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\_queue.pyd
              • Size 31KB
              • SHA256 76bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _socket.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\_socket.pyd
              • Size 81KB
              • SHA256 2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ssl.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\_ssl.pyd
              • Size 174KB
              • SHA256 68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cd.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\charset_normalizer\cd.pyd
              • Size 10KB
              • SHA256 aec205186ce86077a5f8fb469e924cd5f7e183daed53f9de9362e77f3bf3637f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcrypto-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\libcrypto-3.dll
              • Size 5.0MB
              • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libffi-8.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\libffi-8.dll
              • Size 38KB
              • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libssl-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\libssl-3.dll
              • Size 768KB
              • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ndvy_ddoser.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\ndvy_ddoser.dll
              • Size 13.0MB
              • SHA256 5e56073eac05070d5e4af2cc7c82c8cbaf429b2201b146126adc6fed567c1349
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python312.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\python312.dll
              • Size 6.6MB
              • SHA256 8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              select.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\select.pyd
              • Size 30KB
              • SHA256 678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              unicodedata.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\unicodedata.pyd
              • Size 1.1MB
              • SHA256 c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcruntime140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1060_800737_wt82mboZPiQ\vcruntime140.dll
              • Size 116KB
              • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1060-61-0x00007FF6E9260000-0x00007FF6E9AD1000-memory.dmp
              Download

              memory/1972-62-0x00007FF6E9260000-0x00007FF6E9AD1000-memory.dmp
              Download

              memory/1972-63-0x00007FFB23CB0000-0x00007FFB249E0000-memory.dmp
              Download

              memory/1972-210-0x00007FFB23CB0000-0x00007FFB249E0000-memory.dmp
              Download

              memory/1972-213-0x00007FFB23CB0000-0x00007FFB249E0000-memory.dmp
              Download

              memory/1972-219-0x00007FFB23CB0000-0x00007FFB249E0000-memory.dmp
              Download

              memory/1972-228-0x00007FFB23CB0000-0x00007FFB249E0000-memory.dmp
              Download