joker | a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f

Analysis

max time kernel
150s
max time network
158s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe
Size

659KB
MD5

2ee9076557c7c3ff17203b0ccba0501f
SHA1

b235a9d7e422c7ea03a8e36023cbf2de2c04724e
SHA256

a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f
SHA512

9f452245a36e24b5c3ee6854196fd7e409e120f3c4b98833f2801938dfe8dd2f07dbdc5b94b6b629f6d596419b4e2044b527b01a86efdb745f55c6a2bed3f318
SSDEEP

12288:2ITHQuBsNYHuo1y0I5sG1/HkgUcU6kUgnd5aNesU:2ITQURHu8yEG506Yndxs

Score

10^/10

joker infostealer trojan upx

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 1 IoCs

pid	Process
1640	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1712-55-0x0000000000400000-0x00000000005BC000-memory.dmp	upx
behavioral1/files/0x000c0000000054a8-56.dat	upx
behavioral1/files/0x000c0000000054a8-58.dat	upx
behavioral1/memory/1712-60-0x0000000000400000-0x00000000005BC000-memory.dmp	upx
behavioral1/memory/1640-61-0x0000000000400000-0x00000000005BC000-memory.dmp	upx
behavioral1/memory/1640-64-0x0000000000400000-0x00000000005BC000-memory.dmp	upx
behavioral1/files/0x000c0000000054a8-65.dat	upx

Loads dropped DLL 2 IoCs

pid	Process
1712	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe
1640	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\tocabala.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000fc311bf8d7c51ad491c460183a593b04eaa9b0edf0a0ed76b4ceb6481855135a000000000e80000000020000200000008323593aa888ff0f9c06488e7cac81e1e43a551cbfa69fca1855827413758b1320000000de8fb32c0e1d096f63f80c21763f1555198b855f7bae0f78e75dfc2524dcb9d9400000003424897e3e65ac960ef0312c6b3c0207d3059833edf70d48d87462759e912bf4842982c0b760cc85524f39ac849bbaf1a0e6256cfc25a529067708cb9177dd1f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372265875"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\tocabala.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FA03DD1-4976-11ED-B25A-FE72C9E2D9C9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90945e6983ddd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000e72f7c802c8bff7d02f7b81aeaa2cbc8823a24f8cfa3bc2e7936df662aba93d9000000000e80000000020000200000001055f94f1953176aca246d78a8f9c8e3ba052d6787ecc0d8e6550a1620ac5d3d900000006c0e50e8094f3dec27ee9e53984a551fab11fc93b899ecb15843e56b9e26b7b2631265cadf6d2ac470194e9e7238e6bca36d09c3b9c96fd62afe92192238902b85fc18c850acd0fc544255795336ea6c3a7d0ad2643b623c6a41956af9c82c07f23c2665bd78e476453acfedb7c3c063a74e74ab0eb77f189551ccbbbaf32e32f338426951d1e935c48792b2bed0c01f40000000e99be52c1697f52203f395712118be30098c6435be38dd43dfe0706cd107f5f52e060f1c3f3829dcbb66ecc629a4c79025af9f49be159781ff3d82f413e4a871	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1712	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe
1640	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1712	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe
1712	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe
1712	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe
1712	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe
1640	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy
1640	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy
1640	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy
1640	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy
2000	iexplore.exe
2000	iexplore.exe
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1640	1712	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe	27
PID 1712 wrote to memory of 1640	1712	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe	27
PID 1712 wrote to memory of 1640	1712	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe	27
PID 1712 wrote to memory of 1640	1712	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe	27
PID 1640 wrote to memory of 2000	1640	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy	30
PID 1640 wrote to memory of 2000	1640	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy	30
PID 1640 wrote to memory of 2000	1640	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy	30
PID 1640 wrote to memory of 2000	1640	a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy	30
PID 2000 wrote to memory of 1968	2000	iexplore.exe	31
PID 2000 wrote to memory of 1968	2000	iexplore.exe	31
PID 2000 wrote to memory of 1968	2000	iexplore.exe	31
PID 2000 wrote to memory of 1968	2000	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe
"C:\Users\Admin\AppData\Local\Temp\a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy
  C:\Users\Admin\AppData\Local\Temp\a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.tocabala.com/thread-250-1-1.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

Filesize
7KB

MD5
47de8bc8f07cddf34ba25bd2cf787eef

SHA1
91c59eaa7343f0a2b24d146492bb3e00668e6fe0

SHA256
1a61429886f9fba4e649c67d32ba471fd5cff9a6ec8bec7a8b68490cb257f7b0

SHA512
87685297561df0da238608962d33a3cb070005e8b9d6ac39317aed2a782691476500eaed0ee300e5ed9a8ab1adc39a4b30d9f790611c64ac08fb633ffec13601

Download Submit
C:\Users\Admin\AppData\Local\Temp\a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy

Filesize
659KB

MD5
2ee9076557c7c3ff17203b0ccba0501f

SHA1
b235a9d7e422c7ea03a8e36023cbf2de2c04724e

SHA256
a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f

SHA512
9f452245a36e24b5c3ee6854196fd7e409e120f3c4b98833f2801938dfe8dd2f07dbdc5b94b6b629f6d596419b4e2044b527b01a86efdb745f55c6a2bed3f318

Download Submit
C:\Users\Admin\AppData\Local\Temp\a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy

Filesize
659KB

MD5
2ee9076557c7c3ff17203b0ccba0501f

SHA1
b235a9d7e422c7ea03a8e36023cbf2de2c04724e

SHA256
a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f

SHA512
9f452245a36e24b5c3ee6854196fd7e409e120f3c4b98833f2801938dfe8dd2f07dbdc5b94b6b629f6d596419b4e2044b527b01a86efdb745f55c6a2bed3f318

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0ITD01M2.txt

Filesize
608B

MD5
446b0dabe3a386873e1a17bc322c062e

SHA1
9ce6e2381b8a6720470e1d1afb83e210a57e2307

SHA256
c90993c7e7ac08c816f7300006e2ae30a4f99d6eee95b0f72fcfaa9d353692d4

SHA512
a9dd64e3b4a16ac07c73a1c827e92bb4f44c39744c0776779015c01cdaaafe583ede15d68a6efb9de3c16a042300e1d960ea1c880f9649b0e20980668ffe7f3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Z1Y1B36R.txt

Filesize
297B

MD5
38fc4d9186e2fcf22b0e173f4ff78ccd

SHA1
3638e4a34a2252f8d3135a2809906dd21d9542cf

SHA256
5987429ab021241e2b2f44643424e4e34e9a523ab64e36e48aac13b387407e2d

SHA512
5b1b3f0a75b106aa9ee27b0e9bb07ca7bc36274e18612fb63fc9b889b53c23d2bfa44e2c75482f1e83107f886d5ad9daa6ad736b6f572b3882890ba76158a368

Download Submit
\Users\Admin\AppData\Local\Temp\a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f.dmy

Filesize
659KB

MD5
2ee9076557c7c3ff17203b0ccba0501f

SHA1
b235a9d7e422c7ea03a8e36023cbf2de2c04724e

SHA256
a537621e9dd330cc6973fa3962ee872043373d9aa1c6ee99f6f90d7fe2f1ac8f

SHA512
9f452245a36e24b5c3ee6854196fd7e409e120f3c4b98833f2801938dfe8dd2f07dbdc5b94b6b629f6d596419b4e2044b527b01a86efdb745f55c6a2bed3f318

Download Submit
\Users\Admin\AppData\Local\Temp\ziplib.dll

Filesize
453KB

MD5
6df0ed0afe162198116be68aba60e0c4

SHA1
bd0ca25ff4e495717be7345933aaa90755e5a6ca

SHA256
14172cccc2b24d7b490b6038c9493e64d5cab4afeee62014710dfad546eec9dc

SHA512
6696ec1e2261e44e1259609f74e95c205165048d94e581f44b09b87fc70e89b2eaeecd09b7de9cb9735dab0b9d90dd4ff7b5ac07e4b5bd8e5f502e71bbfdb757

Download Submit
memory/1640-61-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download
memory/1640-63-0x00000000036D0000-0x0000000003747000-memory.dmp

Filesize
476KB

Download
memory/1640-64-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download
memory/1712-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1712-60-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download
memory/1712-55-0x0000000000400000-0x00000000005BC000-memory.dmp

Filesize
1.7MB

Download