Analysis
- max time kernel
174s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/06/2022, 03:45
Static task
static1
Behavioral task
behavioral1
Sample
3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe
- Size 189KB
- Sample220621-ebfkxachf3
- SHA256 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9
- MD5 3cb577465c985e8b34afc6e40fa8d458
- SHA1 4c416ba9ac99e0357dfd30fe39eb897d51bd8195
- SHA512 473d1e066af7dd35052bbf8b3cfa87aa273d87754c532f059a224ab19818b103fe76d2ffcdb9b2e0e59c1aa8505538e17abbd175ca40724b2a9452da84653673
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
gootkit
Botnet
-
2855
C2
-
me.jmitchelldayton.com
-
otnhmtkwodm1.site
Attributes
-
vendor_id
2855
Signatures
- Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2792 wrote to memory of 3672 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 79 PID 2792 wrote to memory of 3672 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 79 PID 2792 wrote to memory of 3672 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe"C:\Users\Admin\AppData\Local\Temp\3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe"1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exeC:\Users\Admin\AppData\Local\Temp\3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe --vwxyz2⤵PID:3672
-