Overview
overview
10Static
static
102222-main/Build.exe
windows7_x64
102222-main/Build.exe
windows10_x64
102222-main/...se.dll
windows7_x64
12222-main/...se.dll
windows10_x64
12222-main/OTC.dll
windows7_x64
12222-main/OTC.dll
windows10_x64
12222-main/OTC2.dll
windows7_x64
12222-main/OTC2.dll
windows10_x64
12222-main/aurora.dll
windows7_x64
12222-main/aurora.dll
windows10_x64
12222-main/...ty.dll
windows7_x64
12222-main/...ty.dll
windows10_x64
32222-main/gan.exe
windows7_x64
102222-main/gan.exe
windows10_x64
102222-main/mySThe.exe
windows7_x64
102222-main/mySThe.exe
windows10_x64
102222-main/myporno.exe
windows7_x64
102222-main/myporno.exe
windows10_x64
82222-main/pandora.dll
windows7_x64
12222-main/pandora.dll
windows10_x64
102222-main/pass.exe
windows7_x64
102222-main/pass.exe
windows10_x64
102222-main/petya.exe
windows7_x64
62222-main/petya.exe
windows10_x64
62222-main/sheyhST.exe
windows7_x64
102222-main/sheyhST.exe
windows10_x64
102222-main/...io.exe
windows7_x64
102222-main/...io.exe
windows10_x64
72222-main/test.exe
windows7_x64
32222-main/test.exe
windows10_x64
32222-main/token.exe
windows7_x64
62222-main/token.exe
windows10_x64
6Analysis
-
max time kernel
120s -
max time network
50s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
30-07-2021 07:53
Behavioral task
behavioral1
Sample
2222-main/Build.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
2222-main/Build.exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
2222-main/NanoSense.dll
Resource
win7v20210410
Behavioral task
behavioral4
Sample
2222-main/NanoSense.dll
Resource
win10v20210410
Behavioral task
behavioral5
Sample
2222-main/OTC.dll
Resource
win7v20210408
Behavioral task
behavioral6
Sample
2222-main/OTC.dll
Resource
win10v20210410
Behavioral task
behavioral7
Sample
2222-main/OTC2.dll
Resource
win7v20210408
Behavioral task
behavioral8
Sample
2222-main/OTC2.dll
Resource
win10v20210410
Behavioral task
behavioral9
Sample
2222-main/aurora.dll
Resource
win7v20210408
Behavioral task
behavioral10
Sample
2222-main/aurora.dll
Resource
win10v20210410
Behavioral task
behavioral11
Sample
2222-main/fatality.dll
Resource
win7v20210410
Behavioral task
behavioral12
Sample
2222-main/fatality.dll
Resource
win10v20210408
Behavioral task
behavioral13
Sample
2222-main/gan.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
2222-main/gan.exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
2222-main/mySThe.exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
2222-main/mySThe.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
2222-main/myporno.exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
2222-main/myporno.exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
2222-main/pandora.dll
Resource
win7v20210408
Behavioral task
behavioral20
Sample
2222-main/pandora.dll
Resource
win10v20210410
Behavioral task
behavioral21
Sample
2222-main/pass.exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
2222-main/pass.exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
2222-main/petya.exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
2222-main/petya.exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
2222-main/sheyhST.exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
2222-main/sheyhST.exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
2222-main/stpastio.exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
2222-main/stpastio.exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
2222-main/test.exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
2222-main/test.exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
2222-main/token.exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
2222-main/token.exe
Resource
win10v20210410
General
-
Target
2222-main/pass.exe
-
Size
863KB
-
MD5
a27ba5e68cdd7333b8cd5e4ebd558019
-
SHA1
c4e6d99f3979003424ad4cc511a36434944c02b0
-
SHA256
e42ba94ba2b856fdb7aa01b9dee11abd71c55b6fc15e1933a77269deedb57e88
-
SHA512
2edfb1bae88e3088da81fbcf382fa7955998562817eb9f25bfaef6d82cbeb064c93764d1f9f127ad667543854109da6df84938cbb8d9b62eabf3a00ee5699ff1
Malware Config
Signatures
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
Executes dropped EXE 2 IoCs
Processes:
CoderVir Stealer Love Lolz.guru.exe98899.exepid process 1752 CoderVir Stealer Love Lolz.guru.exe 1700 98899.exe -
Loads dropped DLL 7 IoCs
Processes:
pass.exeWerFault.exepid process 1976 pass.exe 1976 pass.exe 876 WerFault.exe 876 WerFault.exe 876 WerFault.exe 876 WerFault.exe 876 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org 7 api.ipify.org 10 wtfismyip.com 11 wtfismyip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 876 1700 WerFault.exe 98899.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
CoderVir Stealer Love Lolz.guru.exe98899.exeWerFault.exepid process 1752 CoderVir Stealer Love Lolz.guru.exe 1752 CoderVir Stealer Love Lolz.guru.exe 1700 98899.exe 876 WerFault.exe 876 WerFault.exe 876 WerFault.exe 876 WerFault.exe 876 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 876 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
CoderVir Stealer Love Lolz.guru.exe98899.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1752 CoderVir Stealer Love Lolz.guru.exe Token: SeDebugPrivilege 1700 98899.exe Token: SeDebugPrivilege 876 WerFault.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
pass.exe98899.exedescription pid process target process PID 1976 wrote to memory of 1752 1976 pass.exe CoderVir Stealer Love Lolz.guru.exe PID 1976 wrote to memory of 1752 1976 pass.exe CoderVir Stealer Love Lolz.guru.exe PID 1976 wrote to memory of 1752 1976 pass.exe CoderVir Stealer Love Lolz.guru.exe PID 1976 wrote to memory of 1752 1976 pass.exe CoderVir Stealer Love Lolz.guru.exe PID 1976 wrote to memory of 1700 1976 pass.exe 98899.exe PID 1976 wrote to memory of 1700 1976 pass.exe 98899.exe PID 1976 wrote to memory of 1700 1976 pass.exe 98899.exe PID 1976 wrote to memory of 1700 1976 pass.exe 98899.exe PID 1700 wrote to memory of 876 1700 98899.exe WerFault.exe PID 1700 wrote to memory of 876 1700 98899.exe WerFault.exe PID 1700 wrote to memory of 876 1700 98899.exe WerFault.exe PID 1700 wrote to memory of 876 1700 98899.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2222-main\pass.exe"C:\Users\Admin\AppData\Local\Temp\2222-main\pass.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CoderVir Stealer Love Lolz.guru.exe"C:\Users\Admin\AppData\Local\Temp\CoderVir Stealer Love Lolz.guru.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\98899.exe"C:\Users\Admin\AppData\Local\Temp\98899.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 12563⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\98899.exeMD5
ac0a9390d50cbc5133523482b31e0735
SHA14d29f350e46df5672f87095033cdfe3710c58b42
SHA256710dec8e4d9f735cab190d54b4b27b23636d98d588b93ddbc112a48427eaa18c
SHA512a5fd9ec8f7b60a63865b1cf85daf76247c677c7a1de0165449680f7640be2d48ff90dd97639c644e013b4c2e429240e0b52804334b49b3ac7903c6d7fd4e8f64
-
C:\Users\Admin\AppData\Local\Temp\98899.exeMD5
ac0a9390d50cbc5133523482b31e0735
SHA14d29f350e46df5672f87095033cdfe3710c58b42
SHA256710dec8e4d9f735cab190d54b4b27b23636d98d588b93ddbc112a48427eaa18c
SHA512a5fd9ec8f7b60a63865b1cf85daf76247c677c7a1de0165449680f7640be2d48ff90dd97639c644e013b4c2e429240e0b52804334b49b3ac7903c6d7fd4e8f64
-
C:\Users\Admin\AppData\Local\Temp\CoderVir Stealer Love Lolz.guru.exeMD5
c10aa673e83a05634292512446b5896d
SHA18ac8a1820c0f907412b8159476348ed690cfbaee
SHA2566040eb35031a150e4ba05d2e808c5d800a051a537ce4b6c68f3f9b0da9a7258e
SHA5122a0bd1ccae71a802ffcfa79a2c15ed54a7c932b63905f8cbd320f8e90af729294e8812ead8bba7853bc5527afba00fdf77d353ad857187a32efb0cfc854a4d67
-
C:\Users\Admin\AppData\Local\Temp\CoderVir Stealer Love Lolz.guru.exeMD5
c10aa673e83a05634292512446b5896d
SHA18ac8a1820c0f907412b8159476348ed690cfbaee
SHA2566040eb35031a150e4ba05d2e808c5d800a051a537ce4b6c68f3f9b0da9a7258e
SHA5122a0bd1ccae71a802ffcfa79a2c15ed54a7c932b63905f8cbd320f8e90af729294e8812ead8bba7853bc5527afba00fdf77d353ad857187a32efb0cfc854a4d67
-
\Users\Admin\AppData\Local\Temp\98899.exeMD5
ac0a9390d50cbc5133523482b31e0735
SHA14d29f350e46df5672f87095033cdfe3710c58b42
SHA256710dec8e4d9f735cab190d54b4b27b23636d98d588b93ddbc112a48427eaa18c
SHA512a5fd9ec8f7b60a63865b1cf85daf76247c677c7a1de0165449680f7640be2d48ff90dd97639c644e013b4c2e429240e0b52804334b49b3ac7903c6d7fd4e8f64
-
\Users\Admin\AppData\Local\Temp\98899.exeMD5
ac0a9390d50cbc5133523482b31e0735
SHA14d29f350e46df5672f87095033cdfe3710c58b42
SHA256710dec8e4d9f735cab190d54b4b27b23636d98d588b93ddbc112a48427eaa18c
SHA512a5fd9ec8f7b60a63865b1cf85daf76247c677c7a1de0165449680f7640be2d48ff90dd97639c644e013b4c2e429240e0b52804334b49b3ac7903c6d7fd4e8f64
-
\Users\Admin\AppData\Local\Temp\98899.exeMD5
ac0a9390d50cbc5133523482b31e0735
SHA14d29f350e46df5672f87095033cdfe3710c58b42
SHA256710dec8e4d9f735cab190d54b4b27b23636d98d588b93ddbc112a48427eaa18c
SHA512a5fd9ec8f7b60a63865b1cf85daf76247c677c7a1de0165449680f7640be2d48ff90dd97639c644e013b4c2e429240e0b52804334b49b3ac7903c6d7fd4e8f64
-
\Users\Admin\AppData\Local\Temp\98899.exeMD5
ac0a9390d50cbc5133523482b31e0735
SHA14d29f350e46df5672f87095033cdfe3710c58b42
SHA256710dec8e4d9f735cab190d54b4b27b23636d98d588b93ddbc112a48427eaa18c
SHA512a5fd9ec8f7b60a63865b1cf85daf76247c677c7a1de0165449680f7640be2d48ff90dd97639c644e013b4c2e429240e0b52804334b49b3ac7903c6d7fd4e8f64
-
\Users\Admin\AppData\Local\Temp\98899.exeMD5
ac0a9390d50cbc5133523482b31e0735
SHA14d29f350e46df5672f87095033cdfe3710c58b42
SHA256710dec8e4d9f735cab190d54b4b27b23636d98d588b93ddbc112a48427eaa18c
SHA512a5fd9ec8f7b60a63865b1cf85daf76247c677c7a1de0165449680f7640be2d48ff90dd97639c644e013b4c2e429240e0b52804334b49b3ac7903c6d7fd4e8f64
-
\Users\Admin\AppData\Local\Temp\98899.exeMD5
ac0a9390d50cbc5133523482b31e0735
SHA14d29f350e46df5672f87095033cdfe3710c58b42
SHA256710dec8e4d9f735cab190d54b4b27b23636d98d588b93ddbc112a48427eaa18c
SHA512a5fd9ec8f7b60a63865b1cf85daf76247c677c7a1de0165449680f7640be2d48ff90dd97639c644e013b4c2e429240e0b52804334b49b3ac7903c6d7fd4e8f64
-
\Users\Admin\AppData\Local\Temp\CoderVir Stealer Love Lolz.guru.exeMD5
c10aa673e83a05634292512446b5896d
SHA18ac8a1820c0f907412b8159476348ed690cfbaee
SHA2566040eb35031a150e4ba05d2e808c5d800a051a537ce4b6c68f3f9b0da9a7258e
SHA5122a0bd1ccae71a802ffcfa79a2c15ed54a7c932b63905f8cbd320f8e90af729294e8812ead8bba7853bc5527afba00fdf77d353ad857187a32efb0cfc854a4d67
-
memory/876-77-0x0000000000000000-mapping.dmp
-
memory/876-83-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1700-66-0x0000000000000000-mapping.dmp
-
memory/1700-76-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/1700-72-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/1752-74-0x000000001BB60000-0x000000001BB62000-memory.dmpFilesize
8KB
-
memory/1752-71-0x000000001B5E0000-0x000000001B651000-memory.dmpFilesize
452KB
-
memory/1752-67-0x0000000000ED0000-0x0000000000ED1000-memory.dmpFilesize
4KB
-
memory/1752-62-0x0000000000000000-mapping.dmp
-
memory/1976-60-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB