Analysis
-
max time kernel
168s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 07:12
Static task
static1
Behavioral task
behavioral1
Sample
8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe
Resource
win7-20220718-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe
-
Size
249KB
-
MD5
de55f92fcc38046896677011e9a4fc2c
-
SHA1
1e5d3815b41cc57d7315126cdff526f3ca8c4bbe
-
SHA256
8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d
-
SHA512
816840838360389cfde7b634cb61206a1b6480f3165050b4faa1f8bf2d99efc7790e201f10f56963e8de4df80c7c6c9ef701c7c1628e4ddc740732537f0ce555
Malware Config
Extracted
Family
gootkit
Botnet
777
C2
chaabattent.com
kladrykroptur.com
madregobilsg.com
kerymarynicegross.com
pillygreamstronh.com
Attributes
-
vendor_id
777
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4820 wrote to memory of 4192 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 39 PID 4820 wrote to memory of 4192 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 39 PID 4820 wrote to memory of 4192 4820 8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe"C:\Users\Admin\AppData\Local\Temp\8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe"1⤵
- Checks BIOS information in registry
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exeC:\Users\Admin\AppData\Local\Temp\8c338feff17e2893d8ef36b0477d6b8e44c6146d4223e0013c99f89a01116a7d.exe --vwxyz2⤵
- Checks BIOS information in registry
PID:4192
-