Overview
overview
10Static
static
102222-main/Build.exe
windows7_x64
102222-main/Build.exe
windows10_x64
102222-main/...se.dll
windows7_x64
12222-main/...se.dll
windows10_x64
12222-main/OTC.dll
windows7_x64
12222-main/OTC.dll
windows10_x64
12222-main/OTC2.dll
windows7_x64
12222-main/OTC2.dll
windows10_x64
12222-main/aurora.dll
windows7_x64
12222-main/aurora.dll
windows10_x64
12222-main/...ty.dll
windows7_x64
12222-main/...ty.dll
windows10_x64
32222-main/gan.exe
windows7_x64
102222-main/gan.exe
windows10_x64
102222-main/mySThe.exe
windows7_x64
102222-main/mySThe.exe
windows10_x64
102222-main/myporno.exe
windows7_x64
102222-main/myporno.exe
windows10_x64
82222-main/pandora.dll
windows7_x64
12222-main/pandora.dll
windows10_x64
102222-main/pass.exe
windows7_x64
102222-main/pass.exe
windows10_x64
102222-main/petya.exe
windows7_x64
62222-main/petya.exe
windows10_x64
62222-main/sheyhST.exe
windows7_x64
102222-main/sheyhST.exe
windows10_x64
102222-main/...io.exe
windows7_x64
102222-main/...io.exe
windows10_x64
72222-main/test.exe
windows7_x64
32222-main/test.exe
windows10_x64
32222-main/token.exe
windows7_x64
62222-main/token.exe
windows10_x64
6Analysis
-
max time kernel
20s -
max time network
127s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
30-07-2021 07:53
Behavioral task
behavioral1
Sample
2222-main/Build.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
2222-main/Build.exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
2222-main/NanoSense.dll
Resource
win7v20210410
Behavioral task
behavioral4
Sample
2222-main/NanoSense.dll
Resource
win10v20210410
Behavioral task
behavioral5
Sample
2222-main/OTC.dll
Resource
win7v20210408
Behavioral task
behavioral6
Sample
2222-main/OTC.dll
Resource
win10v20210410
Behavioral task
behavioral7
Sample
2222-main/OTC2.dll
Resource
win7v20210408
Behavioral task
behavioral8
Sample
2222-main/OTC2.dll
Resource
win10v20210410
Behavioral task
behavioral9
Sample
2222-main/aurora.dll
Resource
win7v20210408
Behavioral task
behavioral10
Sample
2222-main/aurora.dll
Resource
win10v20210410
Behavioral task
behavioral11
Sample
2222-main/fatality.dll
Resource
win7v20210410
Behavioral task
behavioral12
Sample
2222-main/fatality.dll
Resource
win10v20210408
Behavioral task
behavioral13
Sample
2222-main/gan.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
2222-main/gan.exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
2222-main/mySThe.exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
2222-main/mySThe.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
2222-main/myporno.exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
2222-main/myporno.exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
2222-main/pandora.dll
Resource
win7v20210408
Behavioral task
behavioral20
Sample
2222-main/pandora.dll
Resource
win10v20210410
Behavioral task
behavioral21
Sample
2222-main/pass.exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
2222-main/pass.exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
2222-main/petya.exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
2222-main/petya.exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
2222-main/sheyhST.exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
2222-main/sheyhST.exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
2222-main/stpastio.exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
2222-main/stpastio.exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
2222-main/test.exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
2222-main/test.exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
2222-main/token.exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
2222-main/token.exe
Resource
win10v20210410
General
-
Target
2222-main/pass.exe
-
Size
863KB
-
MD5
a27ba5e68cdd7333b8cd5e4ebd558019
-
SHA1
c4e6d99f3979003424ad4cc511a36434944c02b0
-
SHA256
e42ba94ba2b856fdb7aa01b9dee11abd71c55b6fc15e1933a77269deedb57e88
-
SHA512
2edfb1bae88e3088da81fbcf382fa7955998562817eb9f25bfaef6d82cbeb064c93764d1f9f127ad667543854109da6df84938cbb8d9b62eabf3a00ee5699ff1
Malware Config
Signatures
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
Executes dropped EXE 2 IoCs
Processes:
CoderVir Stealer Love Lolz.guru.exe98899.exepid process 1868 CoderVir Stealer Love Lolz.guru.exe 1608 98899.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 wtfismyip.com 8 wtfismyip.com 9 api.ipify.org 10 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1264 1608 WerFault.exe 98899.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
98899.exeWerFault.exeCoderVir Stealer Love Lolz.guru.exepid process 1608 98899.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 1868 CoderVir Stealer Love Lolz.guru.exe 1868 CoderVir Stealer Love Lolz.guru.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
98899.exeCoderVir Stealer Love Lolz.guru.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1608 98899.exe Token: SeDebugPrivilege 1868 CoderVir Stealer Love Lolz.guru.exe Token: SeRestorePrivilege 1264 WerFault.exe Token: SeBackupPrivilege 1264 WerFault.exe Token: SeDebugPrivilege 1264 WerFault.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
pass.exedescription pid process target process PID 3368 wrote to memory of 1868 3368 pass.exe CoderVir Stealer Love Lolz.guru.exe PID 3368 wrote to memory of 1868 3368 pass.exe CoderVir Stealer Love Lolz.guru.exe PID 3368 wrote to memory of 1608 3368 pass.exe 98899.exe PID 3368 wrote to memory of 1608 3368 pass.exe 98899.exe PID 3368 wrote to memory of 1608 3368 pass.exe 98899.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2222-main\pass.exe"C:\Users\Admin\AppData\Local\Temp\2222-main\pass.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\CoderVir Stealer Love Lolz.guru.exe"C:\Users\Admin\AppData\Local\Temp\CoderVir Stealer Love Lolz.guru.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\98899.exe"C:\Users\Admin\AppData\Local\Temp\98899.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 19243⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1264
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\98899.exeMD5
ac0a9390d50cbc5133523482b31e0735
SHA14d29f350e46df5672f87095033cdfe3710c58b42
SHA256710dec8e4d9f735cab190d54b4b27b23636d98d588b93ddbc112a48427eaa18c
SHA512a5fd9ec8f7b60a63865b1cf85daf76247c677c7a1de0165449680f7640be2d48ff90dd97639c644e013b4c2e429240e0b52804334b49b3ac7903c6d7fd4e8f64
-
C:\Users\Admin\AppData\Local\Temp\98899.exeMD5
ac0a9390d50cbc5133523482b31e0735
SHA14d29f350e46df5672f87095033cdfe3710c58b42
SHA256710dec8e4d9f735cab190d54b4b27b23636d98d588b93ddbc112a48427eaa18c
SHA512a5fd9ec8f7b60a63865b1cf85daf76247c677c7a1de0165449680f7640be2d48ff90dd97639c644e013b4c2e429240e0b52804334b49b3ac7903c6d7fd4e8f64
-
C:\Users\Admin\AppData\Local\Temp\CoderVir Stealer Love Lolz.guru.exeMD5
c10aa673e83a05634292512446b5896d
SHA18ac8a1820c0f907412b8159476348ed690cfbaee
SHA2566040eb35031a150e4ba05d2e808c5d800a051a537ce4b6c68f3f9b0da9a7258e
SHA5122a0bd1ccae71a802ffcfa79a2c15ed54a7c932b63905f8cbd320f8e90af729294e8812ead8bba7853bc5527afba00fdf77d353ad857187a32efb0cfc854a4d67
-
C:\Users\Admin\AppData\Local\Temp\CoderVir Stealer Love Lolz.guru.exeMD5
c10aa673e83a05634292512446b5896d
SHA18ac8a1820c0f907412b8159476348ed690cfbaee
SHA2566040eb35031a150e4ba05d2e808c5d800a051a537ce4b6c68f3f9b0da9a7258e
SHA5122a0bd1ccae71a802ffcfa79a2c15ed54a7c932b63905f8cbd320f8e90af729294e8812ead8bba7853bc5527afba00fdf77d353ad857187a32efb0cfc854a4d67
-
memory/1608-115-0x0000000000000000-mapping.dmp
-
memory/1608-121-0x0000000000E60000-0x0000000000E61000-memory.dmpFilesize
4KB
-
memory/1608-125-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/1868-114-0x0000000000000000-mapping.dmp
-
memory/1868-120-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/1868-124-0x0000000003140000-0x00000000031B1000-memory.dmpFilesize
452KB
-
memory/1868-126-0x000000001C370000-0x000000001C372000-memory.dmpFilesize
8KB