Analysis
-
max time kernel
128s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
17-10-2021 21:05
Static task
static1
URLScan task
urlscan1
Sample
https://forum.daffodil-bd.com/Template/img/softs/-/volkbank/?r=2341
Behavioral task
behavioral1
Sample
https://forum.daffodil-bd.com/Template/img/softs/-/volkbank/?r=2341
Resource
win10-en-20210920
General
-
Target
https://forum.daffodil-bd.com/Template/img/softs/-/volkbank/?r=2341
-
Sample
211017-zw9ppsdgcq
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "341577501" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30918134" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1346213125" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A5B3CD9-31E9-11EC-AF2E-FE4672F7746C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1336994564" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000008c2b4f25def1d9c9aee728c562c20e481792b767169432854a119b760a783ef4000000000e8000000002000020000000e938b48cf8377944b195f85fe1a62eb63e22cd442baa2b58ca4304eb9b6e0c8f2000000054b207e7d2cd81de92c4c3cdb398214eb9d2d48e705d609653a1ae27b954ada940000000dd620cb573f979bedca5ff7db16974468ce0cf2c87ce6baf0f01802898d69f2eb9ccc98b87ddd1bc5b7c46297da1b841030a9a352869e23099560921fc8cc300 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "341545510" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30918134" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000a8d88e64853a143fa46e0616c3c9f57b3ae8b59d9304e0b1564a61afade47d37000000000e80000000020000200000000a6e25a67ba7f203100c5c6bc1b58e0400f3404f9e19d66111aed3342fc401932000000014d325794bb5d82ad181613bc1cfd0eb46bc26ff90f013d2fc5cccbb3e14dc2a40000000a4f94990570a131a5a0cf37970788ffa65b1785fb3c22bd91f7787600240616654d612d887445c9db9d32bbb3a6e869f466d178323ca75b98fc1536688e6d9f8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0742152f6c5d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cc2f52f6c5d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "341528916" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1336994564" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30918134" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1684 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1684 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1684 iexplore.exe 1684 iexplore.exe 3328 IEXPLORE.EXE 3328 IEXPLORE.EXE 3328 IEXPLORE.EXE 3328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 1684 wrote to memory of 3328 1684 iexplore.exe IEXPLORE.EXE PID 1684 wrote to memory of 3328 1684 iexplore.exe IEXPLORE.EXE PID 1684 wrote to memory of 3328 1684 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://forum.daffodil-bd.com/Template/img/softs/-/volkbank/?r=23411⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
6cc161dfa552b32b57ffb217c3c4e718
SHA1a0a9a1d6c6815cf9e7148386659b99630c0a6c59
SHA2560f2f73b237fc7b973f14aa1b9407d2a3cf90b78223e6a219b0dc1e784761352a
SHA51298887974d9c9f39d981cb90abaf7cc07cc8a97249dfa6c3ae4015042053ef9563fe7231816b6d7a0b6c9ae26870a539961576344114b76356ef93fd98c568ff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
ad4a51647ca5a6fcb60d8481c7705aeb
SHA174505a140b8d799bd79165b2c98d1fccd17905e2
SHA256dd02cfeea1d24bdfcce43b53c221ad69db752182f1d6d33887454778f43f2196
SHA512ae8a58d52ac2b32303f57cd545483970107046f0b297e4c6655323ef3fb94b4495571decdd091b33d303c813403e857b71e50e11d1035cbd9b4ca68704f5b3c1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\GH6GOSZD.cookieMD5
a6b9e2a539636f58f3ee53a573c0af35
SHA1d3750edd0b9dbd2a402ac47fd64efc444ed52cd3
SHA256f17fc4f3a8cb04394d156da0a6986510f3e4dab6e84e5f4b00362d913d77055b
SHA512a7daf71ef1c6b7cdc2e5c1501c1b26861ae4435dc2e4d03f1e58973af3770c1e0ff2bc4386027fd00ed2db1f8ea3a669bc8c3ab05e93911f8fb11feac4996f44
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Z51J2YFK.cookieMD5
580d5b43dbcd937527c4953166adf6c3
SHA11a35608171bb77417baadf8c5909fd58530e0ebd
SHA256774c0a1e370ac91c673adcf102d36486d98947d889983097817fb8716ccc25a0
SHA512744350018b0752593123503bbb6043d03636334e509cd8bfebbd14300bea7083355bd4636d32bea01608d95a1992aac3c634e320ff51f1192ba31b67e358ceec
-
memory/1684-145-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-123-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-122-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-147-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-124-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-125-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-127-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-128-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-129-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-131-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-115-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-133-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-150-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-136-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-137-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-138-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-116-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-142-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-141-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-144-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-132-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-121-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-135-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-149-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-151-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-155-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-156-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-157-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-163-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-164-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-165-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-166-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-167-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-168-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-169-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-173-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-174-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-177-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-178-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-179-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-120-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-119-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/1684-117-0x00007FFF13780000-0x00007FFF137EB000-memory.dmpFilesize
428KB
-
memory/3328-140-0x0000000000000000-mapping.dmp