Analysis
-
max time kernel
174s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-06-2022 03:45
Static task
static1
Behavioral task
behavioral1
Sample
3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe
-
Size
189KB
-
MD5
3cb577465c985e8b34afc6e40fa8d458
-
SHA1
4c416ba9ac99e0357dfd30fe39eb897d51bd8195
-
SHA256
3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9
-
SHA512
473d1e066af7dd35052bbf8b3cfa87aa273d87754c532f059a224ab19818b103fe76d2ffcdb9b2e0e59c1aa8505538e17abbd175ca40724b2a9452da84653673
Malware Config
Extracted
Family
gootkit
Botnet
2855
C2
me.jmitchelldayton.com
otnhmtkwodm1.site
Attributes
-
vendor_id
2855
Signatures
-
Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2792 wrote to memory of 3672 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 79 PID 2792 wrote to memory of 3672 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 79 PID 2792 wrote to memory of 3672 2792 3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe"C:\Users\Admin\AppData\Local\Temp\3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe"1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exeC:\Users\Admin\AppData\Local\Temp\3079b740d91179832f75ba23052eca8c19983252c274740be1e045cb588886c9.exe --vwxyz2⤵PID:3672
-