df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec

Analysis

max time kernel
154s
max time network
157s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 04:34 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
Size

1.3MB
MD5

804d168fc0e2f628d9a489aa0db9e07c
SHA1

b1c217138b5c8db5bca4d5c66110cc686b85835e
SHA256

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec
SHA512

a32935be3d69cb73e45d47ae7813b0fe93f9e22b80ff581ee3846d6760dc0cb626dc4c6214fd4fa0cf1b82dec5fa8c8dadcd9aa50d44d137a72051dfb56f7335
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakY:zrKo4ZwCOnYjVmJPaH

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 840 set thread context of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2024	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
2024	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
2024	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
2024	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
2024	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28
PID 840 wrote to memory of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28
PID 840 wrote to memory of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28
PID 840 wrote to memory of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28
PID 840 wrote to memory of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28
PID 840 wrote to memory of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28
PID 840 wrote to memory of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28
PID 840 wrote to memory of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28
PID 840 wrote to memory of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28
PID 840 wrote to memory of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28
PID 840 wrote to memory of 2024	840	df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe	28

C:\Users\Admin\AppData\Local\Temp\df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
"C:\Users\Admin\AppData\Local\Temp\df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

DNS

cbumi6htzf.0roptbgg23.com

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

Remote address:

8.8.8.8:53

Request

cbumi6htzf.0roptbgg23.com

IN A

Response

cbumi6htzf.0roptbgg23.com

IN A

5.79.71.205

cbumi6htzf.0roptbgg23.com

IN A

5.79.71.225

cbumi6htzf.0roptbgg23.com

IN A

85.17.31.82

cbumi6htzf.0roptbgg23.com

IN A

85.17.31.122

cbumi6htzf.0roptbgg23.com

IN A

178.162.203.202

cbumi6htzf.0roptbgg23.com

IN A

178.162.203.211

cbumi6htzf.0roptbgg23.com

IN A

178.162.203.226

cbumi6htzf.0roptbgg23.com

IN A

178.162.217.107
GET

http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

Remote address:

5.79.71.205:80

Request

GET /cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6 HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: cbumi6htzf.0roptbgg23.com
Connection: Keep-Alive
GET

http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

Remote address:

5.79.71.205:80

Request

GET /cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6 HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: cbumi6htzf.0roptbgg23.com
Connection: Keep-Alive
GET

http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

Remote address:

5.79.71.225:80

Request

GET /cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6 HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: cbumi6htzf.0roptbgg23.com
Connection: Keep-Alive
GET

http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

Remote address:

85.17.31.122:80

Request

GET /cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6 HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: cbumi6htzf.0roptbgg23.com
Connection: Keep-Alive
POST

http://cbumi6htzf.0roptbgg23.com/__dmp__/

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

Remote address:

85.17.31.122:80

Request

POST /__dmp__/ HTTP/1.1
User-Agent: dBrowser 1 CallGetResponse:1
Host: cbumi6htzf.0roptbgg23.com
Content-Length: 1307
Cache-Control: no-cache
POST

http://cbumi6htzf.0roptbgg23.com/__dmp__/

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

Remote address:

85.17.31.122:80

Request

POST /__dmp__/ HTTP/1.1
User-Agent: session
Host: cbumi6htzf.0roptbgg23.com
Content-Length: 3859
Cache-Control: no-cache

5.79.71.205:80

http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6

http

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

614 B
225 B
5
5

HTTP Request

GET http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
5.79.71.205:80

http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6

http

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

614 B
225 B
5
5

HTTP Request

GET http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
5.79.71.205:80

cbumi6htzf.0roptbgg23.com

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

152 B
3
5.79.71.225:80

http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6

http

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

614 B
225 B
5
5

HTTP Request

GET http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
5.79.71.225:80

cbumi6htzf.0roptbgg23.com

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

152 B
3
85.17.31.82:80

cbumi6htzf.0roptbgg23.com

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

152 B
3
85.17.31.122:80

http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6

http

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

614 B
225 B
5
5

HTTP Request

GET http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
85.17.31.122:80

http://cbumi6htzf.0roptbgg23.com/__dmp__/

http

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

1.7kB
265 B
6
6

HTTP Request

POST http://cbumi6htzf.0roptbgg23.com/__dmp__/
85.17.31.122:80

http://cbumi6htzf.0roptbgg23.com/__dmp__/

http

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

5.8kB
305 B
9
7

HTTP Request

POST http://cbumi6htzf.0roptbgg23.com/__dmp__/

8.8.8.8:53

cbumi6htzf.0roptbgg23.com

dns

df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

71 B
199 B
1
1

DNS Request

cbumi6htzf.0roptbgg23.com

DNS Response

5.79.71.205

5.79.71.225

85.17.31.82

85.17.31.122

178.162.203.202

178.162.203.211

178.162.203.226

178.162.217.107

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2024-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2024-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2024-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2024-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2024-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2024-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2024-68-0x00000000754C1000-0x00000000754C3000-memory.dmp

Filesize
8KB

Download
memory/2024-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2024-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2024-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2024-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.