Analysis
-
max time kernel
161s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 07:18
Static task
static1
Behavioral task
behavioral1
Sample
7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe
Resource
win7-20220718-en
windows7-x64
4 signatures
150 seconds
General
-
Target
7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe
-
Size
190KB
-
MD5
cfe77040029dbc2a5a6a416c02017bd0
-
SHA1
3b01ffd567b3443d0613f867a69ce4a60d2d7a26
-
SHA256
7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989
-
SHA512
5bbc23aee0b94c774b9d0795e94f019f2c86e1966a6bbfec0bca0b71fc0c3caa01754fc8960e70fdfa92cc627bc06602a90aba96d2af25b09b7b2e4d1ec21332
Malware Config
Extracted
Family
gootkit
Botnet
2855
C2
me.jmitchelldayton.com
otnhmtkwodm1.site
Attributes
-
vendor_id
2855
Signatures
-
Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe Set value (int) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4556 wrote to memory of 3664 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 86 PID 4556 wrote to memory of 3664 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 86 PID 4556 wrote to memory of 3664 4556 7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe"C:\Users\Admin\AppData\Local\Temp\7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe"1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exeC:\Users\Admin\AppData\Local\Temp\7af90590d1cd4e6f6d9d54bfc65e827d5ed0b062241e92d0a71eb991d079d989.exe --vwxyz2⤵PID:3664
-