Analysis
- user interaction
yes - max time kernel
142s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 07:47
General
- Target BruteL4-DDOS.exe
- Size 11.5MB
- Sample260825-jmk2zsybph
- SHA256 bd95ec107878109859ff396ef71c76eb801ed4b25a167b49c8f0b8e112fbe361
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 6 IoCs
- Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Users\Admin\AppData\Local\Temp\BruteL4-DDOS.exe"C:\Users\Admin\AppData\Local\Temp\BruteL4-DDOS.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BruteL4DDOS.exe"C:\Users\Admin\AppData\Local\Temp\BruteL4DDOS.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BruteL4DDOS.exe"C:\Users\Admin\AppData\Local\Temp\BruteL4DDOS.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mode 140, 405⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode 140, 406⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title Brute - by billythegoat3565⤵
- Executes a command shell one-liner
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BruteL4-DDOS.exe"C:\Users\Admin\AppData\Local\Temp\BruteL4-DDOS.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BruteL4DDOS.exe
VCRUNTIME140.dll
_ctypes.pyd
_socket.pyd
base_library.zip
libffi-7.dll
python310.dll
select.pyd
memory/1296-15-0x000000001D780000-0x000000001DF86000-memory.dmp
memory/1296-7-0x00007FF6E3DD0000-0x00007FF6E4DDC000-memory.dmp
memory/1296-12-0x000000001CB40000-0x000000001D384000-memory.dmp
memory/1296-13-0x0000000003150000-0x0000000003156000-memory.dmp
memory/1296-14-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/1296-10-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/1296-8-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/1296-9-0x00007FF6E3DD0000-0x00007FF6E4DDC000-memory.dmp
memory/1296-2-0x00007FFC80030000-0x00007FFC80031000-memory.dmp
memory/1296-11-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/1296-5-0x00007FFCC536F000-0x00007FFCC5370000-memory.dmp
memory/1296-103-0x00007FF6E3DD0000-0x00007FF6E4DDC000-memory.dmp
memory/1296-1-0x00007FFC80000000-0x00007FFC80002000-memory.dmp
memory/1296-104-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/1296-68-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/1296-6-0x00007FFCC51E0000-0x00007FFCC5B84000-memory.dmp
memory/1296-0-0x00007FF6E3DD0000-0x00007FF6E4DDC000-memory.dmp
memory/1632-102-0x00007FFCC0DC0000-0x00007FFCC1225000-memory.dmp
memory/1632-111-0x00007FFCD9090000-0x00007FFCD909F000-memory.dmp
memory/1632-110-0x00007FFCD8490000-0x00007FFCD84B4000-memory.dmp
memory/1632-117-0x00007FFCD8460000-0x00007FFCD846D000-memory.dmp
memory/1632-116-0x00007FFCD8470000-0x00007FFCD8489000-memory.dmp
memory/1632-118-0x00007FFCC0DC0000-0x00007FFCC1225000-memory.dmp
memory/1632-120-0x00007FFCD8490000-0x00007FFCD84B4000-memory.dmp
memory/1632-122-0x00007FFCD8470000-0x00007FFCD8489000-memory.dmp
memory/4988-19-0x00007FF6E3DD0000-0x00007FF6E4DDC000-memory.dmp
memory/4988-16-0x0000000140000000-0x0000000140CB4000-memory.dmp