Analysis
- max time kernel
151s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system - submitted
24/07/2022, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe
Resource
win7-20220718-en
windows7-x64
4 signatures
150 seconds
General
- Target c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe
- Size 189KB
- Sample220724-vyjtvacefp
- SHA256 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f
- MD5 a5bb21de4e9bf7463f59001bdaf99d30
- SHA1 820820f490424b1f4cf4e3d0787b005eaa8e5115
- SHA512 7f41b70b57ea81153098ac44a0cf65b0414df10278117f9c234cb3206336ee3e14dce8c3e38610756ecbe4b86f40933906670260b9fb73ea6da21c9dbf9c939e
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
gootkit
Botnet
-
2855
C2
-
me.jmitchelldayton.com
-
otnhmtkwodm1.site
Attributes
-
vendor_id
2855
Signatures
- Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4332 wrote to memory of 4728 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 79 PID 4332 wrote to memory of 4728 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 79 PID 4332 wrote to memory of 4728 4332 c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe"C:\Users\Admin\AppData\Local\Temp\c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe"1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exeC:\Users\Admin\AppData\Local\Temp\c64223741483af87e7bde5b4f6dd2bc9e22ffe15c65670d2d5a1646b0bbe902f.exe --vwxyz2⤵PID:4728
-