Overview
overview
9Static
static
9CliIkosNet...on.dll
windows7-x64
1CliIkosNet...on.dll
windows10-2004-x64
1CliIkosNet...et.dll
windows7-x64
1CliIkosNet...et.dll
windows10-2004-x64
1CliIkosNet...ib.dll
windows7-x64
1CliIkosNet...ib.dll
windows10-2004-x64
1CliIkosNet...rs.dll
windows7-x64
1CliIkosNet...rs.dll
windows10-2004-x64
1CliIkosNet...ns.dll
windows7-x64
1CliIkosNet...ns.dll
windows10-2004-x64
1CliIkosNet...ta.dll
windows7-x64
1CliIkosNet...ta.dll
windows10-2004-x64
1CliIkosNet...ng.dll
windows7-x64
1CliIkosNet...ng.dll
windows10-2004-x64
1CliIkosNet...el.dll
windows7-x64
1CliIkosNet...el.dll
windows10-2004-x64
1CliIkosNet...ms.dll
windows7-x64
1CliIkosNet...ms.dll
windows10-2004-x64
1CliIkosNet...nq.dll
windows7-x64
1CliIkosNet...nq.dll
windows10-2004-x64
1CliIkosNet...ml.dll
windows7-x64
1CliIkosNet...ml.dll
windows10-2004-x64
1CliIkosNet...em.dll
windows7-x64
1CliIkosNet...em.dll
windows10-2004-x64
1CliIkosNet...ms.dll
windows7-x64
1CliIkosNet...ms.dll
windows10-2004-x64
1CliIkosNet...ng.dll
windows7-x64
1CliIkosNet...ng.dll
windows10-2004-x64
1CliIkosNet...ew.dll
windows7-x64
1CliIkosNet...ew.dll
windows10-2004-x64
1CliIkosNet...ew.dll
windows7-x64
1CliIkosNet...ew.dll
windows10-2004-x64
1Analysis
-
max time kernel
85s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2023 17:37
Behavioral task
behavioral1
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Newtonsoft.Json.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Newtonsoft.Json.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Renci.SshNet.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Renci.SshNet.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/SharpZipLib.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/SharpZipLib.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Buffers.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Buffers.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Data.DataSetExtensions.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Data.DataSetExtensions.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Data.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Data.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Drawing.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Drawing.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.ServiceModel.dll
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.ServiceModel.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Windows.Forms.dll
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Windows.Forms.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Xml.Linq.dll
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Xml.Linq.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Xml.dll
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.Xml.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral23
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.dll
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/System.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Telerik.ReportViewer.WinForms.dll
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Telerik.ReportViewer.WinForms.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Telerik.Reporting.dll
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Telerik.Reporting.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral29
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Telerik.WinControls.ChartView.dll
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Telerik.WinControls.ChartView.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Telerik.WinControls.GridView.dll
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
CliIkosNet 2.0.16.28 R4 BANOBRAS/Telerik.WinControls.GridView.dll
Resource
win10v2004-20230220-en
General
-
Target
CliIkosNet 2.0.16.28 R4 BANOBRAS/SharpZipLib.dll
-
Size
112KB
-
MD5
c37a2719bd83ba766b29d8f83cee6258
-
SHA1
9f92916429f9f52723d18079899e63715a32ab36
-
SHA256
1e2cf0f79d2e5d6b10e21067bb86c4df1fc8b28f45fb7ef92ae67a2dcee3be0e
-
SHA512
64670d11ea9edea0c96bf8de64f005149109ed5fd5a6c1fc5f825ab6b8e1349b7524afadb564f144bda933ca61de891fb6c7a5f2508eb98094f97197eb4d58d9
-
SSDEEP
1536:V821slfy1MQ+0qxrJtTVsDWsHtdLSvvnnoU+q4UrviOBW6zsAzSYxCS/LsDuaCCt:a2GE+0qxrPuLSvR6OBPljsD5CCitwZj
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 4484 firefox.exe Token: SeDebugPrivilege 4484 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 4484 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 3440 wrote to memory of 4484 3440 firefox.exe firefox.exe PID 3440 wrote to memory of 4484 3440 firefox.exe firefox.exe PID 3440 wrote to memory of 4484 3440 firefox.exe firefox.exe PID 3440 wrote to memory of 4484 3440 firefox.exe firefox.exe PID 3440 wrote to memory of 4484 3440 firefox.exe firefox.exe PID 3440 wrote to memory of 4484 3440 firefox.exe firefox.exe PID 3440 wrote to memory of 4484 3440 firefox.exe firefox.exe PID 3440 wrote to memory of 4484 3440 firefox.exe firefox.exe PID 3440 wrote to memory of 4484 3440 firefox.exe firefox.exe PID 3440 wrote to memory of 4484 3440 firefox.exe firefox.exe PID 3440 wrote to memory of 4484 3440 firefox.exe firefox.exe PID 4484 wrote to memory of 4496 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 4496 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 2884 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 3496 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 3496 4484 firefox.exe firefox.exe PID 4484 wrote to memory of 3496 4484 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\CliIkosNet 2.0.16.28 R4 BANOBRAS\SharpZipLib.dll",#11⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.0.526583775\487824613" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac1c9b02-9dea-47a1-9f10-6955bbbb0e4e} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 1916 2a25e816858 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.1.529132911\297777202" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3795baa1-3ce2-4db8-867f-1a6f5f4e482f} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 2316 2a250972858 socket3⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.2.1187494661\33223163" -childID 1 -isForBrowser -prefsHandle 3140 -prefMapHandle 3252 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9afcff58-dfaa-4f31-8802-851240f1512c} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 3264 2a261514758 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.3.1687019830\892132346" -childID 2 -isForBrowser -prefsHandle 1292 -prefMapHandle 3108 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7bf0411-4eb1-424a-92b2-9954e13c0f19} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 3000 2a250971958 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.4.1745496650\362191952" -childID 3 -isForBrowser -prefsHandle 3784 -prefMapHandle 3780 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76ac6c79-23be-4b57-be6c-a870a1263480} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 1292 2a2627ac258 tab3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmpFilesize
164KB
MD56aad4dd2294a7f776f96c1df811ef418
SHA1a9800ea14ba47f73865be3852582b92ade75c7e1
SHA2565b06d2e4ffded224037a17306b5e2e4db4d56f613d11574bcd60c9a1d790bd50
SHA51246c9a89aa6fe3590c82a6891f21d42e0aeb9e041927e3f7646f64e59a2ec79d365561e5bb791a93a41a2c71102b850ffc84dd6f4fc2ffbd3459f5339bb8c6e6b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.jsFilesize
6KB
MD5413b929ffdda1b7a40d1c6a296363709
SHA1819f1fb714ba6748737c0d6527c3bee82e212707
SHA2569058db6eeee34a9462b146ed1c5aea9baf83d3085236b4223b55c78f79e1c309
SHA51251a646c65c9932662d5fc599607a20b97cb0f716ba6dab404764cc90ddfaa598dd5336dcf940c2366654f35920d4da60fd4d1e23330d97acd6c32bc2695c8f3d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs.jsFilesize
6KB
MD5108b97b1ff7efbdb1aecce96d55ff2e5
SHA1bb72b2e0c3d859fe5e821632307a32df331b55e1
SHA256c5e19d4313b524fffc4859f4fac05ea3dcf408714a736dbd0bb7fcdf5131f80e
SHA512e0f7678424e68957a1cb521786e9e4e54c179f9a263b04d0c6a96147cb1e242b58bda3e74e6f142dcd9b6dd313a0061c3050af334b149eab9a8040f923da84dc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionCheckpoints.json.tmpFilesize
259B
MD5c8dc58eff0c029d381a67f5dca34a913
SHA13576807e793473bcbd3cf7d664b83948e3ec8f2d
SHA2564c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
SHA512b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore.jsonlz4Filesize
882B
MD5c9ac5d0ad14e1f63f4778064cd2980c7
SHA176d6f82db69844e202a220cf52be11fc67245808
SHA25655912aea22ea4da47ece9a1c4aabd5bbe41d472157ae0ec3577d4db37865e183
SHA5123bf9ca75cd24480df5c8cd5929ffbbbc0174c68f1b7b4e2ecd933970d37c30c1975de702d089a5f3e599a8b83c4d373dd3272a340571c03c7f1907251c9d0459
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\xulstore.json.tmpFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd