Analysis
-
max time kernel
120s -
max time network
160s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-02-2022 07:57
Static task
static1
Behavioral task
behavioral1
Sample
1be90c72735d56e2f9ee9583d6bece1b9e6a78ecc475f08d6f133863b56256ea.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1be90c72735d56e2f9ee9583d6bece1b9e6a78ecc475f08d6f133863b56256ea.exe
Resource
win10v2004-en-20220112
General
-
Target
1be90c72735d56e2f9ee9583d6bece1b9e6a78ecc475f08d6f133863b56256ea.exe
-
Size
54KB
-
MD5
c81424677bcfcf9eeafa3504d87e5c63
-
SHA1
9393744eaf2cd526e3007a0363d2291faba236b2
-
SHA256
1be90c72735d56e2f9ee9583d6bece1b9e6a78ecc475f08d6f133863b56256ea
-
SHA512
4ac18a81065b70e44052705753e7d5bf5585e05db8618d2758434e7e126dda8b39c010d0521d237c440fe3da766f107992517a542ac9b8b11ac1f98f7958a6fc
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2329389628-4064185017-3901522362-1000\BackFiles_encoded01.txt
http://chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion/gate.php?data=ivYTRlYfLdBVUjByXafcBOGYeQdILBqyPG51ODqyvHXDpi53YysD5mR8B0Nzlu8i744rMHlyTbo9ZxEJeZPtN7e7aREEKF6YNjxBCCqW5E7O2gsWYHVP6DEAXhQsxqhz2aYiZh9TF%2BN1KgZGfY%2BeceGQIH8%2BLRm2JXFBH36C7TzkyyJoZjEe9jM7VE8l6IRxwZgLI19RaPFfYgAMZtS2Ee%2BmfzdzLW%2BcMmB0PC%2FgjH3akiIneX5D%2FjtgBUk9uPcxvq4mBBdGaoMBOwcLDOCSSfu3Bn18K27fbjxjFEay1mrTt2p%2FH0wI4hckU0YNzL5j7M8VPVx1H7dYYBJISqLsZvidQDdzLW%2BTYRFHNRif%2BTbOuj00eGJs1mU%2BAEs4iMYF%2FZUkCjopRYAcMWRBHvOuTPy%2BJnZKfkz1fwRPHV%2FE7DTFj0c1LmdhmGMEXCE1874hur4AIF1pXOs0IBJITpzLPMPPY3EhU0qJFGRnNBjfkDzfmiMNO1Ze0kIuYT1hgccyy75fPxxFWJ43MXg2F%2BCLVr%2ByAyFxPhvFOw9DKkiw5RT%2BhHwtGnpvnHBgdjoon7FOu4sgM0B2Tf5bLWYNTpzuBeyuZBIEaUeyGAV4HSr%2FrTP6t3wNcXZK5Go%2FQ0l6pM8S6Jh3FyFGCOITNGERbuyzbvLPPChAdF7pVDZcA2rCyx3ZrmIBJUpLhHBgdkc29uxx0rZxFjB4G8BHB2I7Tr7AKuSaITIcKl2JYmdWAx7S6XXrsyUpfFhQs0cvAw1CxOBhv8FddD9qVPVnFEhBb5%2BTIbq6FAFfPhvFQjZjOCnDwmrhkHRwDnBhtjo9XDcv5LVn%2B4kedUVPY%2B5OPHpPfYbqdriwdxA%2BVFWULGBkRRLQn1e5qSkBanRe1W1lDhNms6FhzK9VFSVMaeJwYHYkGsLrQeGvYXdLVUjyOzBZAGOg5SXr0yEAJWlFvxEZeSt4lZ580M43Nk16fvZlA0M%2BVsPCMee4XR4BWFyCN3cCNBmC7kbjjwURXFF74FZyBThcobAFzcNkdCRHH7MEFFkRLOCaffiFCxA8b0%2FdXi4CK3zI7gPJtCIVMVp6uwJ3AjQpwJZw%2Bo9hd0tMHaI%2BEVAqNYPSZ%2FuCa2NkXUWlEzQFJg7GlHPOy2F3Tyhb%2F2AmTzZDlchqyYN9LhUvTOkwB14BCILuQrqYLDNGPhvBaw5YIGOV6hjflWZxYW5b6DAaBgUakY5Kwp8yB2BdWPJ%2FcgU4TZ3BIr6GYREvaViBAiQHNTzWiEzn2XcB
Signatures
-
suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
suricata: ET MALWARE WIN32/KOVTER.B Checkin
suricata: ET MALWARE WIN32/KOVTER.B Checkin
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\c:\$recycle.bin\s-1-5-21-2329389628-4064185017-3901522362-1000\desktop.ini 1be90c72735d56e2f9ee9583d6bece1b9e6a78ecc475f08d6f133863b56256ea.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 whatismyipaddress.com 9 whatismyipaddress.com