Analysis
-
max time kernel
151s -
max time network
55s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 17:23
Static task
static1
Behavioral task
behavioral1
Sample
c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe
Resource
win7-20220718-en
windows7-x64
4 signatures
150 seconds
General
-
Target
c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe
-
Size
189KB
-
MD5
a5bb21de4e9bf7463f59001bdaf99d30
-
SHA1
820820f490424b1f4cf4e3d0787b005eaa8e5115
-
SHA256
c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f
-
SHA512
7f41b70b57ea81153098ac44a0cf65b0414df10278117f9c234cb3206336ee3e14dce8c3e38610756ecbe4b86f40933906670260b9fb73ea6da21c9dbf9c939e
Malware Config
Extracted
Family
gootkit
Botnet
2855
C2
me.jmitchelldayton.com
otnhmtkwodm1.site
Attributes
-
vendor_id
2855
Signatures
-
Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1920 wrote to memory of 2028 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 28 PID 1920 wrote to memory of 2028 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 28 PID 1920 wrote to memory of 2028 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 28 PID 1920 wrote to memory of 2028 1920 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe"C:\Users\Admin\AppData\Local\Temp\c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe"1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exeC:\Users\Admin\AppData\Local\Temp\c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe --vwxyz2⤵PID:2028
-