Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • resource
    win7v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1bbbae729c33ea1ff7f99ddca6317e05a4242d63

  • Sample

    191018-jyewsk7k72

  • SHA256

    e39e7b370667db88b6fd90410873a312599e750e66708cab60e681e61b9c5c24

Score
N/A

Malware Config

Extracted

Family

ursnif

Botnet

500

C2

http://myhomesitter.fun

Attributes
  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    1.320669898e+09

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • dns_servers

    107.174.86.134

    107.175.127.22

rsa_pubkey.base64
serpent.plain

Signatures

  • Suspicious use of WriteProcessMemory 6 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • ursnif family
    family
  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
    adwarespyware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bbbae729c33ea1ff7f99ddca6317e05a4242d63.exe
    "C:\Users\Admin\AppData\Local\Temp\1bbbae729c33ea1ff7f99ddca6317e05a4242d63.exe"
    1⤵
      PID:1200
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      PID:1124
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:275457 /prefetch:2
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2036
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      PID:1996
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2032
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      PID:1536
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:2
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1068
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      PID:1512
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:2
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:280
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      PID:1596
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1596 CREDAT:275457 /prefetch:2
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1144
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      PID:1768
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1920

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1200-0-0x0000000002965000-0x000000000297B000-memory.dmp

      Filesize

      88KB

      Download

    • memory/1200-1-0x0000000004150000-0x0000000004161000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1200-2-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

      Download

    • memory/2036-3-0x0000000005F10000-0x0000000005F33000-memory.dmp

      Filesize

      140KB

      Download