Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 28 and Nov. 4. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org , or ClamAV.net .
For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. A visual depiction of the MITRE ATT&CK techniques associated with each threat is also shown. In these images, the brightness of the technique indicates how prevalent it is across all threat files where dynamic analysis was conducted. There are five distinct shades that are used, with the darkest indicating that no files exhibited technique behavior and the brightest indicating that technique behavior was observed from 75 percent or more of the files.
The most prevalent threats highlighted in this roundup are:
Threat Name Type Description Win.Dropper.Ramnit-9976458-0 Dropper Ramnit is a banking trojan that monitors web browser activity on an infected machine and collects login information from financial websites. It also has the ability to steal browser cookies and attempts to hide from popular antivirus software. Win.Ransomware.TeslaCrypt-9976475-0 Ransomware TeslaCrypt is a well-known ransomware family that encrypts a user's files with strong encryption and demands Bitcoin in exchange for a file decryption service. A flaw in the encryption algorithm was discovered that allowed files to be decrypted without paying the ransomware, and eventually, the malware developers released the master key allowing all encrypted files to be recovered easily. Win.Dropper.Nanocore-9976516-0 Dropper Nanocore is a .NET remote access trojan. Its source code has been leaked several times, making it widely available. Like other RATs, it allows full control of the system, including recording video and audio, stealing passwords, downloading files and recording keystrokes. Win.Ransomware.Expiro-9976530-0 Ransomware Expiro is a known file infector and information-stealer that hinders analysis with anti-debugging and anti-analysis tricks. Win.Dropper.NetWire-9976531-0 Dropper NetWire is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam, remote desktop and read data from connected USB devices. NetWire is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails. Win.Trojan.Zegost-9976584-0 Trojan Zegost is a remote access trojan designed to provide an attacker with complete control over an infected system. Capabilities include monitoring keystrokes, collecting video footage from the webcam, and uploading/executing follow-on malware. Zegost appears to be derived from Gh0stRAT, which is a well-known remote access trojan that had its source code leaked, significantly lowering the barrier to entry for actors looking to modify and reuse the code in new attacks. Win.Dropper.Formbook-9976602-0 Dropper Formbook is an information stealer that attempts to collect sensitive information from an infected machine by logging keystrokes, stealing saved web browser credentials and monitoring information copied to the clipboard. Win.Malware.Qbot-9976624-0 Malware Qakbot, aka Qbot, has been around since at least 2008. Qbot primarily targets sensitive information like banking credentials but can also steal FTP credentials and spread across a network using SMB. Win.Packed.Mikey-9976634-0 Packed Mikey is a trojan that installs itself on the system, collects information and communicates with a C2 server, potentially exfiltrating sensitive information. This threat can also receive additional commands and perform other malicious actions on the system, such as installing additional malware upon request.
Threat Breakdown Win.Dropper.Ramnit-9976458-0 Indicators of Compromise IOCs collected from dynamic analysis of 11 samples Registry Keys Occurrences <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER Value Name: AntiVirusOverride 11 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER Value Name: AntiVirusDisableNotify 11 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER Value Name: FirewallDisableNotify 11 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER Value Name: FirewallOverride 11 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER Value Name: UpdatesDisableNotify 11 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER Value Name: UacDisableNotify 11 <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: EnableLUA 11 <HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE Value Name: EnableFirewall 11 <HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE Value Name: DoNotAllowExceptions 11 <HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE Value Name: DisableNotifications 11 <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: Start 11 <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: Start 11 <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: Start 11 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION Value Name: jfghdug_ooetvtgk 11 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: JudCsgdy 11 <HKLM>\SYSTEM\CONTROLSET001\SERVICES\WUAUSERV Value Name: Start 11 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Windows Defender 11 <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: Userinit 11 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: Userinit 11
Mutexes Occurrences {7930D12C-1D38-EB63-89CF-4C8161B79ED4}11
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 217[.]20[.]116[.]13810 72[.]26[.]218[.]7010 195[.]201[.]179[.]20710 208[.]100[.]26[.]24510 35[.]205[.]61[.]6710 142[.]250[.]80[.]4610 64[.]225[.]91[.]7310
Domain Names contacted by malware. Does not indicate maliciousness Occurrences ltvfyknd[.]com10 nwgehuej[.]com10 ochmemne[.]com10 ovedpgmh[.]com10 plsjybruf[.]com10 qqximuos[.]com10 qsatesrenfj[.]com10 qymovaxblw[.]com10 rohpwrralh[.]com10 rybnpwpdxp[.]com10 shlbftknj[.]com10 urnjufcm[.]com10 wevufrlvbmp[.]com10 xdxocfqkpfs[.]com10 xkluqdruhdy[.]com10 yhvvaanlaw[.]com10 augrkyqwgni[.]com10 gsxgbfendh[.]com10 rqcryxlm[.]com10 acwuxyrasn[.]com10 weyvrdbd[.]com10 tqfgavkr[.]com10 spbmrgvk[.]com10 arkdnbwpf[.]com10 hxblclgkdw[.]com10
*See JSON for more IOCs
Files and or directories created Occurrences %LOCALAPPDATA%\bolpidti11 %LOCALAPPDATA%\bolpidti\judcsgdy.exe11 %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\judcsgdy.exe11
File Hashes 05137f6ab767b193b5c4f93848348f54c7b16e3934db1749d4a2df611137f385061947fa22ca40de1b07fa6e681021ac77fd1586846056a84f2325712c378d1a 0f647586c3d93ecc3af4028b0584353adfe2b9a60ffdcde3fbbfc5e0a3584492 24a2edb8efdf3e34cda083e4d17e1ff661ecd52d4cd3f0d3fe02e44774373432 293c97369187dca742a5679bc1111d89f113a7c2fe6973dc2d1199f5b6a1fbdb 3a87f11dddfdb3914035a2bd4b62de3196651dfad874e1b502ae12c485399622 67f7b5fd32444e240ea880a668ef980317c2fafdbb0ef627c06f172a08c10416 6a188dd1314a3d2bd6a5769c712f79c7719874e7ece53c045a22ba6f52be61d2 892cdf46d7b2754c273f0996fba8ef71554bea80b47f55a0ede6728f5eb73225 c496b66c5758ba90b111d94d63cfa75fa915926933222c04d3e827fa194037ee ea0db1aa89275513d8001b6b5f62dd2198b659663294cdbc36070c1e98b99e03
Coverage Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella WSA
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Ransomware.TeslaCrypt-9976475-0 Indicators of Compromise IOCs collected from dynamic analysis of 14 samples Registry Keys Occurrences <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: EnableLinkedConnections 11 <HKCU>\SOFTWARE\ZSYS11 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: LanguageList 11 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.CHECK.0 Value Name: CheckSetting 11 <HKCU>\SOFTWARE\ZSYS Value Name: ID 11 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Acronis 11 <HKCU>\Software\<random, matching '[A-Z0-9]{14,16}'>11 <HKCU>\Software\<random, matching '[A-Z0-9]{14,16}'> Value Name: data 11 <HKLM>\SYSTEM\CONTROLSET001\SERVICES\\PARAMETERS\PORTKEYWORDS\DHCP Value Name: Collection 1
Mutexes Occurrences 7845621432412411 Global\3621b8e1-598a-11ed-9660-001517124ddd1 Global\361f20d1-598a-11ed-9660-0015171d88401
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 178[.]33[.]117[.]4511 34[.]160[.]111[.]14511 216[.]245[.]213[.]776 18[.]232[.]18[.]1356 52[.]202[.]227[.]1255 77[.]247[.]182[.]2514 77[.]247[.]182[.]2431
Domain Names contacted by malware. Does not indicate maliciousness Occurrences myexternalip[.]com11 irseek[.]com11 djepola[.]com11 aprenderabailarsevillanas[.]com11 apotheke-stiepel[.]com11 woodenden[.]com11
Files and or directories created Occurrences \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I08BO8F.xlsx11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I11KHR4.doc11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I5QKHLN.doc11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I62TWBD.ppt11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I6FZORX.doc11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IABMX83.pdf11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IAJ2Y6R.pdf11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IALGTCS.xlsx11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IGTBBSA.accdb11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IH49RPF.ppt11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IH71GGR.ppt11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IJKODPH.pdf11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IJP965K.accdb11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IKY5R3M.pdf11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IMYCSIT.pdf11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$ISLP722.doc11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IXLC77A.pdf11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IXUL2U1.doc11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IYSR1FU.ppt11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IZ2GMJW.XLSX11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$R08BO8F.xlsx11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$R11KHR4.doc11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$R5QKHLN.doc11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$R62TWBD.ppt11 \$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$R6FZORX.doc11
*See JSON for more IOCs
File Hashes 30614f6bbaf10137089bb8b1c1bf69b8b131052750b96db1f26e689e59dcc5bb 312f7e1c6a5b1e71dfce6edf658aff098118eb0bccb3676878aba4ca55e8ce53 5917d58345869b83616cb51ce33331f96a23a8c72b6529342c08c0980d481ea4 5d7d96c5024591d45d2bd92329981945eb6400453547df0711e445b66da1c740 679cb4ef0c102db6bc4d6a8dcc15a0a8728c8f1714eec55253a41a29e76cf956 975676952320d4ad6516b9ed31dd1373e9f828e602e7690f55782fc30cb5ba8b a4e2d68231dd5b9dd62a072082b68d2688de0441596c3b1c927989995afe5a0b c6867c81e37c2574297f01f95953b71e89f6b9f513bc7fbd6278cb0d9d6031ed d07d13129187b86b7550e32804201beda9338f33232b122886d35adb55edf73e d5003563374846618799b3c82852aa90fbf0bd5de8e2c6f50b4c4ae8dd78bb00 d5ae4f92b78010fdc637e4ae606e00ab8be0a7bf02d3d33116b558cf5d0df3bb e0de998f6a4c61df0aab37eb1c3e169f608235c42daf4a17a70de00ae1321ec4 e0f1b11228df0ae77c74fb87f229c1a0edc8f3a2e5d385f32eee5b47f15855bb ebf67e0c91d02c84b17dcf1ef61c12c8f5e4c5e5c789db3fa240f1f1c516c672
Coverage Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella N/A WSA N/A
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Dropper.Nanocore-9976516-0 Indicators of Compromise IOCs collected from dynamic analysis of 14 samples Registry Keys Occurrences <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: LanguageList 8 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: AGP Manager 5 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: WindowsUpdate 5 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: AutoUpdate 4 <HKCU>\ENVIRONMENT Value Name: SEE_MASK_NOZONECHECKS 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\dhcpqec.dll,-100 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\dhcpqec.dll,-101 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\dhcpqec.dll,-103 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\dhcpqec.dll,-102 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\napipsec.dll,-1 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\napipsec.dll,-2 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\napipsec.dll,-4 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\napipsec.dll,-3 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\tsgqec.dll,-100 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\tsgqec.dll,-101 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\tsgqec.dll,-102 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\tsgqec.dll,-103 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\eapqec.dll,-100 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\eapqec.dll,-101 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\eapqec.dll,-102 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @%SystemRoot%\system32\eapqec.dll,-103 2 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 20744aa7e3ab56e90a843fa06bd99e6d 2 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 20744aa7e3ab56e90a843fa06bd99e6d 2 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: DisableTaskMgr 1 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM1
Mutexes Occurrences 8-3503835SZBFHHZ3 Global\{d0691a45-4fc4-42f8-9eb9-754e345ceb2c}3 20744aa7e3ab56e90a843fa06bd99e6d2 73M9N-T0-UB83K6J1 S-1-5-21-2580483-124416950890721 S-1-5-21-2580483-124431068402011 1N6PO-QCTT825WY-1 S-1-5-21-2580483-124439999126741 073A3D-6T418-C-B1 Global\{042723c4-0804-4212-bf56-4b1b2669ca7c}1 O5L2BA2WRAFEx2MB1 7P2MN2S27-74YFZB1 Global\{0aeffa29-f3e3-4c27-b5c4-5ee7e27a451f}1 Global\{0fd7962c-bd41-4ed0-bcf3-944f142a1566}1
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 34[.]102[.]136[.]1803 194[.]5[.]98[.]2133 194[.]55[.]186[.]1292 198[.]54[.]117[.]2181 198[.]54[.]117[.]2121 195[.]110[.]124[.]1331 66[.]96[.]160[.]1301 217[.]19[.]248[.]1321 192[.]169[.]69[.]261 75[.]2[.]115[.]1961 75[.]2[.]26[.]181 104[.]21[.]83[.]1491 209[.]17[.]116[.]1631 34[.]117[.]168[.]2331 54[.]91[.]59[.]1991 64[.]190[.]63[.]1111 31[.]31[.]196[.]511 194[.]5[.]98[.]2191 199[.]59[.]243[.]2221 23[.]230[.]152[.]1341 45[.]33[.]6[.]2231 45[.]77[.]55[.]1611 202[.]61[.]84[.]2101 38[.]6[.]77[.]911 76[.]76[.]21[.]91
*See JSON for more IOCs
Domain Names contacted by malware. Does not indicate maliciousness Occurrences nexaustin[.]ddns[.]net3 www[.]xn--agroisleos-09a[.]com1 www[.]cacconsults[.]com1 411speed[.]duckdns[.]org1 lowaspeed[.]ddnsfree[.]com1 www[.]thespecialtstore[.]com1 www[.]sqlite[.]org1 www[.]fbo[.]app1 www[.]fabricsandfashion[.]com1 www[.]stjohnzone6[.]com1 www[.]co-gpco[.]com1 www[.]tigermedlagroup[.]com1 www[.]www1111cpw[.]com1 www[.]duetpbr[.]com1 www[.]duenorthrm[.]com1 www[.]bbobbo[.]one1 www[.]onlyonesolutions[.]com1 www[.]ndppoc[.]info1 www[.]confurn[.]net1 www[.]nyhedsbrev671[.]shop1 www[.]blast4me[.]com1 www[.]3egcfl[.]cyou1 www[.]fistfulofeuros[.]org1 www[.]8065yp[.]com1 www[.]azalpay[.]site1
*See JSON for more IOCs
Files and or directories created Occurrences %HOMEPATH%\temp14 %TEMP%\RegSvcs.exe7 %APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C56 %APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\Logs6 %APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\Logs\Administrator6 %APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\run.dat6 %TEMP%\tmp<random, matching [A-F0-9]{1,4}>.tmp6 %ProgramFiles(x86)%\AGP Manager5 %ProgramFiles(x86)%\AGP Manager\agpmgr.exe5 %APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\task.dat5 %System32%\Tasks\AGP Manager5 %System32%\Tasks\AGP Manager Task5 %TEMP%\8_56\mlknlqw.pif1 %TEMP%\8_56\ofstkibdks.mp31 %TEMP%\8_56\pdofc.pdf1 %TEMP%\8_56\rejtghdwwt.icm1 %TEMP%\8_56\snmgega.dll1 %TEMP%\8_56\swev.dll1 %TEMP%\8_56\tbhdnssur.gcf1 %TEMP%\8_56\uopse.ini1 %TEMP%\8_56\wkgwwrb.docx1 %TEMP%\8_56\wwikp.exe1 %TEMP%\8_56\xawk.msc1 %TEMP%\8_56\xtcwtnqb.exe1 %TEMP%\10_71\biciulubl.mp31
*See JSON for more IOCs
File Hashes 0015048adbf3c3c9e4d685430113d63866e2a2f44d68cb3ee84274b4e2936638 1544ca80f8a8b8b9b87a1f9cf1e223c73a30bebe20ef7954f083ccb14275a519 62b5227656a58b1358c35100d0b5e8116ebe5b891a69f0a6f3ece869305e3193 6a4d2f72c82049aaec9996ed5de2756862f32678c33751e1ce449036cd66bf67 6ef54172371d62f47ca10add5d4e16991c08ab1c43effec3d1caf25718d2ed08 7cd5d3d08b5baa37925bbcac0fc1a5d6c72bcbf72d134b20d2fec7a19ea04e4b 98c63a20b549889019289912d4cffdf6b167585bdfdd0b1b0d9993da3c62ca63 b1f692dd52aae8317db7cfd262a4bcc053cf721fc7a00bf66f4acc7cb5cc6cbc bb1de2f25a652c68b959b1dd2a0b379a71c052ec5a3810f5363fe5e8f172764d bc10c1fdffe23e13bf9cfc59b5e85e1db2f4f99af014d775a24cdc47920c3fec cd7309e874f6ca76a451bb90026e79736afdf309cc853948424b00ffa7985b73 dcff2133f606823c5704cde43408c1d49f76fec97a1fcc973d4d3dc69651a4ed dd0ec4c79c60c7e53fc117800214901f5c55b04aceb455ecb88ceeb12958df60 f8ddc46b03f741a383da261761ed44b95fa58135b64a7b4577f8e08443d9f4bb
Coverage Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella WSA
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Ransomware.Expiro-9976530-0 Indicators of Compromise IOCs collected from dynamic analysis of 12 samples Registry Keys Occurrences <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Bandera 12
Mutexes Occurrences Local\Kasimir_C12 Local\Kasimir_E12 Local\azov12
Files and or directories created Occurrences %ProgramFiles%\Zulu\zulu-8\demo\jvmti\mtrace\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\jvmti\mtrace\lib\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\jvmti\versionCheck\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\jvmti\versionCheck\lib\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\jvmti\waiters\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\jvmti\waiters\lib\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\management\FullThreadDump\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\management\JTop\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\management\MemoryMonitor\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\management\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\management\VerboseGC\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\FileChooserDemo\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\FileChooserDemo\nbproject\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\Font2DTest\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\Font2DTest\nbproject\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\Metalworks\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\Metalworks\nbproject\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\Notepad\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\Notepad\nbproject\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\SampleTree\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\SampleTree\nbproject\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\SwingApplet\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\SwingApplet\nbproject\RESTORE_FILES.txt12 %ProgramFiles%\Zulu\zulu-8\demo\nbproject\jfc\TableExample\RESTORE_FILES.txt12
*See JSON for more IOCs
File Hashes 1404a5b4c34cf6e2975a2600ffaa778ae2d2b4fee305a64a122ea8269bcd4a72 154f2b05a85946c0ad74802f75dc8f9fdb79130b0450415f8354b619a7e03683 18a681a88dc35e4ff7c9e67eac567023c29f7944db294fb77b556950b7f83232 1c1e53930a9863e3f862acb6774f858c91c9bc51c77587c79313755b617b7b51 1ee2e603fb17105558daef8fad81f052d36a71636fdf3ed38fd0b4d924081c56 22caaaef25d4d59ad771969e3ba361d5e33fcd5fb7a25d8875fe6bc51a0acb13 4ea0c9a1843a89fb4c469053eb0b817ae4eec70d91f93ef2683a4731ac30030a 606ac339cab05c2641f30a6deee5eddcdb5a82ad94430e8250ed2dc429754ae9 66a01949db2504792ef56fe73352fe75bab35f5995ff94114d7e98bcbebb7b04 7c6d05752c07f45b057b47bd3102dec87b9cea071c8b9ecd12455b0fb123529f d0a92b410313e350366ab68993db429ac1c99f2e82c7437d13d8736b5716dc19 fd95d28ea97ac602301b212c5fda3e7c9974531a9d2e6c2f72990579248c40b9
Coverage Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security N/A Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella N/A WSA N/A
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Dropper.NetWire-9976531-0 Indicators of Compromise IOCs collected from dynamic analysis of 16 samples Registry Keys Occurrences <HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: Shell 11 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Images 4 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\PMT3XT1Q2K4 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\PMT3XT1Q2K Value Name: inst 4 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: remcos 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: LanguageList 2 <HKCU>\SOFTWARE\NETWIRE1 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @C:\Windows\system32\DeviceCenter.dll,-2000 1 <HKCU>\SOFTWARE\NETWIRE Value Name: HostId 1 <HKCU>\SOFTWARE\NETWIRE Value Name: Install Date 1 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\4JAOA17T9V1
Mutexes Occurrences <32 random hex characters>6 Remcos_Mutex_Inj2 4K4OB47WX4V4CKL52 65RNS1Q-967B20H82 remcos_lxsjaviytncaprp2 -1 Mutex1 Global\{341de909-532f-4e88-9ebb-7d3eb122bb6e}1 Global\563b8e01-5a4b-11ed-9660-001517ee01311 ITVC91 Global\{cdbf811f-ed5e-4c07-872b-324356f515af}1
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 103[.]168[.]204[.]1524 150[.]242[.]14[.]614 34[.]102[.]136[.]1802 3[.]64[.]163[.]502 1[.]2[.]3[.]41 103[.]224[.]182[.]2101 51[.]159[.]67[.]1351 20[.]103[.]85[.]331 23[.]221[.]227[.]1691 3[.]19[.]100[.]431 13[.]248[.]243[.]51 188[.]126[.]90[.]91 74[.]201[.]28[.]1091 184[.]105[.]237[.]1941 192[.]227[.]130[.]261 136[.]243[.]154[.]1151 3[.]136[.]101[.]2241 170[.]106[.]49[.]1221 50[.]87[.]196[.]1201
Domain Names contacted by malware. Does not indicate maliciousness Occurrences iphanyi[.]webredirect[.]org4 jlf716galpha[.]ddns[.]net2 www[.]destinny[.]com2 www[.]iregentos[.]info2 www[.]socia1security[.]net2 microsoft[.]com1 apps[.]identrust[.]com1 iphanyi[.]edns[.]biz1 www[.]movementspecialistslv[.]com1 h[.]top4top[.]io1 www[.]blossomenterpriseuganda[.]com1 www[.]rubenvdsande[.]com1 amnartrat[.]ddns[.]net1 www[.]agencybuilderforum[.]com1 www[.]thegolfclubatcirclec[.]com1 www[.]alfrednelson[.]com1 www[.]communityinsuranceut[.]com1 www[.]qqbokep[.]com1 www[.]dotalogy[.]com1 www[.]elegancescent[.]com1 www[.]blkdenim[.]com1 www[.]paintedinafrica[.]com1 www[.]onurtel[.]com1 www[.]tqiawy[.]xyz1 www[.]rainbowbanks[.]com1
*See JSON for more IOCs
Files and or directories created Occurrences %ProgramFiles%\Microsoft DN15 %LOCALAPPDATA%\Microsoft Vision5 %ProgramData%4 %ProgramData%\images.exe4 %ProgramData%:ApplicationData4 %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat4 %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start4 %APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C52 %APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\Logs2 %APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\Logs\Administrator2 %APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\run.dat2 %APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\task.dat2 %System32%\Tasks\AGP Manager2 %APPDATA%\remcos2 %APPDATA%\remcos\remcos.exe2 %TEMP%\install.bat2 %APPDATA%\pbfK0ESxVB628Cf22 %APPDATA%\Install1 %APPDATA%\Install\Host.exe1 %TEMP%\System1 %APPDATA%\Sqlite31 %APPDATA%\Sqlite3\sqlite3.dll1 %APPDATA%\1jL8REIPgFpnQFM41 %APPDATA%\4nTKFdOD39Vq0zE31 %TEMP%\System\xmrig.exe1
*See JSON for more IOCs
File Hashes 04d5963e859229bb3c0bb76c311867a0fb150029bd580cdc22118eaabf17516d 058feb3df2afbd547d12bca6ca4d28b2b393ff3c6fc71f325f264cae9143b6a6 0619a227ff1e3c46b54a03797cdc0054afa0e24137596fdae7676a70f2175710 1efc23c2527eb5ba80630a9610b6ef71709a90ed8f06716588b6fea6c4a55134 42e74142a3bf1fc2f2ccbfa3efd76a8e2752eade8d373cc88b8b537fddbe91e3 514bf43a45b1c5e689a005653f1cf352efb81f051a5259c8e5b9c6b42bce8537 53084f740ea9d129f3bcb5ba899de173a2bbe8f6689f9112c9de6a6c8c9db9e2 574efe8cce09da26ed0ae70376857c12d1282c55e113ad65523307364900de16 6b07a24b6a25c6dd641bd3ba5296d6e5ba702722b27b5640855c14973d1aff17 970fe6d1c87273191ee73f2dadea1f9e25d456676ecd6997acd30bbda05de43a 9affeeb392ec57f487776cb8da8e8abb89b3250aefa2d2f0b29997b0bd33d00f a996609920ba3ed689dbe009d3e81128c097de7ec043def6074c57b408576b86 b37072cc25f1b87fd2f44abc257bb98d49a91b1621d79e794076f2f24bc18ba0 d14d3980e62e5da9ca4d13e777ee3502875f3b9799f9ed6b963b2518661d4edc d2d127529cae65a8a493f03533a2ecb698a185ad2d137cb539884d3858189ee9 eb0c8f8343c74cd148800ed8fe373f25a0c719503fb71c9852bda347527fb8d4
Coverage Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella WSA
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Trojan.Zegost-9976584-0 Indicators of Compromise IOCs collected from dynamic analysis of 25 samples Registry Keys Occurrences <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Kris 25
Mutexes Occurrences chinaheikee__inderjns25
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 67[.]198[.]148[.]5225
File Hashes 133716a04bbffa588c6db4e5e669cd9472999d2e85720b9e529c0201adbca5cc 1443bd94987127cdf9f5e2ef166c68bc84cdff73321f4ad2544cdb5e6afb003a 1cdc8ea3feb05cc2dc3a115d1a7cce4a2f0f49d3d1dac38dc0db79888f2da044 23c85949bfbca0b3cf200e3c2b0f5f532c9fdea0f2bd76981800f36006234ba8 241b4c0e102739a369cf75446395ddc4aedf8a6adf70b389aacdf9756b81e4b2 253a67526137ded4e31148bbd0f626c4958c0b9556b84eedb5ab0089de5a93c6 27b1ccae49978938d337d25867d53edaa85c79de960630e716bfef7bc970681b 27e92dc76eb5b788f97234b0864ec5790786ed2952db7b1d3276230b794c456a 2809026f932fa0d4f4b9dc7581b0bea9fc7f89ae4c089762c3ba15cdc4125033 2c7e1c403507e3a670e55301487f201ea7d809ae36ea5366ae2334dd4e2272ab 2eeeaf618db3e354eb28cbad932d8719daed755fed0562356188261708d2c329 3189468e0a1d64542850814df7c29408a686dca7575237ce0a48390805e88768 331b3bac64be57f59d637a6c629a53712edd6a1001e0df2c21a29f982cb48e6a 34f85da54491fec5b9d76fc50972ab2f263f00f55a6f5cbde0af8ffec790e156 428b563c09c494f6b8359bbcbc1d3035c39bee5693540c7727281cb945edd10c 45c726068a37dd7290bcd1a7e24f6b49b2b6216291ed4c39225f4eb31ccadded 4ef5bbdf5a5812adb57f26b798a18c3657ae799d8e71495103b0c7b16e0b8dbf 56ea4f3e4216bd917a9c45aac3f7079b930bceb9ad01ac5663c641d0b80d10a3 5777c12ea053512d4437a9548e2967b55736fc6f65b56c3609ef3681fb235961 57c3bb5da234d033fb6c8ac120dab66d6c021af2ea16348bd17315fad6a38cf4 5ddb66a224d7d8feea79bafbf7d8fd5e7e73ddff1437546003dc28eb0e733126 6199b3083e824fdef37a97b3116812ffd846d26124ad8a454444ba2dd9d4f028 6334aa60d77d8c4c9e06cbfcdbd13f23bae6d29876708805403721cd4bfed588 6424ccc4b554e23138adeb7a8926d8c651838fc161e7c9ae8bdfb56f9775cdaa 6ae30d306a4bfaa65465d1c26b13645c9ba3fb1e90960fa8f19bf82d02294e03
Coverage Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security N/A Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella N/A WSA N/A
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Indicators of Compromise IOCs collected from dynamic analysis of 24 samples Registry Keys Occurrences <HKCU>\SOFTWARE\APPSTORE24 <HKCU>\SOFTWARE\APPSTORE Value Name: LastTime 24 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: LanguageList 1 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @explorer.exe,-7001 1
Files and or directories created Occurrences %TEMP%\ns<random, matching '[a-z][A-F0-9]{1,4}'>.tmp24 %TEMP%\ns<random, matching '[a-z][A-F0-9]{4}'>.tmp\System.dll24 %TEMP%\ns<random, matching '[a-z][A-F0-9]{4}'>.tmp\NSDIALOGS.DLL24 %TEMP%\nsm373D.tmp\modern-wizard.bmp1 %TEMP%\nsr3624.tmp\modern-wizard.bmp1 %TEMP%\nsh3412.tmp\modern-wizard.bmp1 %TEMP%\nsc3C7B.tmp\modern-wizard.bmp1 %TEMP%\nsm3A97.tmp\modern-wizard.bmp1 %TEMP%\nsm3D07.tmp\modern-wizard.bmp1 %TEMP%\nsc3663.tmp\modern-wizard.bmp1 %TEMP%\nsn355A.tmp\modern-wizard.bmp1 %TEMP%\nst2544.tmp\modern-wizard.bmp1 %TEMP%\nsy3EFB.tmp\modern-wizard.bmp1 %TEMP%\nsi41D.tmp\modern-wizard.bmp1 %TEMP%\nscAF0B.tmp\modern-wizard.bmp1 %TEMP%\nsi527B.tmp\modern-wizard.bmp1 %TEMP%\nstE97C.tmp\modern-wizard.bmp1 %TEMP%\nsxDF5E.tmp\modern-wizard.bmp1 %TEMP%\nsi51EF.tmp\modern-wizard.bmp1 %TEMP%\nsdD0CE.tmp\modern-wizard.bmp1 %TEMP%\nstC9CC.tmp\modern-wizard.bmp1 %TEMP%\nsnE0C.tmp\modern-wizard.bmp1 %TEMP%\nsg832B.tmp\modern-wizard.bmp1 %TEMP%\nss9F81.tmp\modern-wizard.bmp1 %TEMP%\nsi5191.tmp\modern-wizard.bmp1
*See JSON for more IOCs
File Hashes 0a781b03d64413436c911a3994d95af5d2a45ee649f707a979fbe88337a51215 0b36838cf62eb07200b7a91385ce85aba4d028889f3bdd9002ff6a7c133f2936 13c8649974576fe8448a569f3831e67ac2ec41f65ae2605c55cdbe8520f57c9d 1b5c03dad39a612f4b79925343278bb7a0c4466a15bdd5a601f1314e6e58a0e0 286c3326921512170ca8c9318173773b47bfdb8b825358942b4c33f4c26f9f23 31c0a24d60b818ea8e7b17d3547559376b0dd22a24dc41325aff268e0bd8918a 46efe9c4fb87fa2dc79398c2bfbef1fceef22eb9a3b8a9cfc8ae7f293f143736 56e020e483283b6b1974a5808d8ff19cf9023fcc928a643fcc26b030a6f8c1e3 653211977632579659671c25632f882b3aaa56f8030036b0e32e648b44930e24 66e3237dc10316747f42a9423021483168b1332b8077f8dbba44272a5e84b5e2 69d2c94c148875e54384537664abe487d1565d21a89d893df3ff169f7d952d14 6a788c3e4b5b68a65562bf5e8ef8e2dd3b3ba7f71edfe757d351d9ee4d516ec9 72ef1f44392e726243c6f7c74cc7deb2aa0c1880d6248ce2000ed0462858baf3 7968bd184b3752a316f9f25b8e22b8ba14c3270eb9b7fb46eb3b46d4ad557fe9 9428f34d7862cd99d41a50f9085c77d096cf7eddf0cedf889adeb754f623f368 b8416e5271bd5d02808e330d25f4f57cff0cb5a8e1487dad21b392e26d42488b c95fc54d4fcdb80609d8e4fdfb04596296a9bdece21d3429bafa48a191006840 d17383a87703f33ddd7c968d39d9a9aa07153d65fdb37423490d2118c22a3ca4 d2024286d06081a3119a548ab80551b8d3ea12d2fdc2b399026d23508c2a1380 eb1951d80eac5104f5b02793df52ce540e4a0843494e816541334a09b31c0f08 f24740999c04fb15e868d5e62d79043e84b9ecc7956c6ffeeb0bee76a9c25793 f4090c819f4a5d1da2245244c2e786bceae53a9ba3065f5ffd89588bf8e516be fb32b93c36578ec09eafe1375538a392d114d3f695400b0720bbb95b70b9b203 fc004c3d0dfdf7d5433da40be3b6e048a6490fe959eaf6af74d0b580256e9dc3
Coverage Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security N/A Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella N/A WSA N/A
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Malware.Qbot-9976624-0 Indicators of Compromise IOCs collected from dynamic analysis of 15 samples Registry Keys Occurrences <HKCU>\SOFTWARE\MICROSOFT\DFWOFIK15 <HKCU>\SOFTWARE\MICROSOFT\DFWOFIK Value Name: bd63ad6b 15 <HKCU>\SOFTWARE\MICROSOFT\DFWOFIK Value Name: bf228d17 15 <HKCU>\SOFTWARE\MICROSOFT\DFWOFIK Value Name: 79eea72 15 <HKCU>\SOFTWARE\MICROSOFT\DFWOFIK Value Name: 7a96a5f8 15 <HKCU>\SOFTWARE\MICROSOFT\DFWOFIK Value Name: c22ac29d 15 <HKCU>\SOFTWARE\MICROSOFT\DFWOFIK Value Name: 5dfca0e 15 <HKCU>\SOFTWARE\MICROSOFT\DFWOFIK Value Name: 88fc7d25 15 <HKCU>\SOFTWARE\MICROSOFT\DFWOFIK Value Name: f7b512d3 15
Mutexes Occurrences Global\{06253ADC-953E-436E-8695-87FADA31FDFB}15 {06253ADC-953E-436E-8695-87FADA31FDFB}15 {357206BB-1CE6-4313-A3FA-D21258CBCDE6}15
Files and or directories created Occurrences %APPDATA%\Microsoft\Xtuou15 \TEMP\10fb7039d24f8593a7de808f8204ead1.dll1 \TEMP\3ffe560127804443b98953de7c9dd5fa.dll1 \TEMP\ecd95a8bfe2510b6591a9d1d23defcb0.dll1 \TEMP\73c5c9c056a12cd9ea3d4976f90a1757.dll1
File Hashes 086bcf673f9fcd920b1c91ff72db4677f48fd4c0ff13f80544fd258384c3acd4 14a953b85f253f28776ef4a5e4f5a7e6932b419f0d671ef1e9ffe94fb038b1cc 1683d02dece55de1ebf9d12b206a1533a6883949a178241d8176fce48f7ce734 433214982d46f0de6929708e2c7d667eec2206ae23c707099f6866dae0ae672b 67f064cd7d5dd94f7521f32fd858804535a84d506758069453f7c9f2b41fd0e1 68497fe4d9c25c38e9419c4d617a62fedbbe272ef2623c6d61d6794fb047338a 6d85b2269488db695e8168433ef58626d5b9bb4b9ee38b02057067d941be2d4f 7e861ab117b7a9dd4f4460956d921209124a5e9a2e735d1e05b267f424c2fd99 a50452279e028138c0ddfdc852f860b951a097b9e1615449007f4ac06bdb8e29 ac3dab50e68f843d869d6d1fdd756c9da8a4482e204f5f7d050fa7ceb1fdcbef b2917acf6f61cf328fa6f010519a49e8ce3d6b1407abb833e73e078559a8dd41 b5c7ad50f7d8bf745718dcc5a6ddd1a33a1303eecf14bf66e2fbeffd87ad9b53 c4033d78ebb05d37ed2604b75521690298172240fbbc74e4409d63fd4cc9046c d4d435b2af9729aa9ce933182024508b8d89be94e88a91734f8d8719bb660f9a f2c0e1729b763502229cc520e4171fa5c0d1c5e5bf1168c2500c1b973da618e0
Coverage Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security N/A Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella N/A WSA N/A
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Packed.Mikey-9976634-0 Indicators of Compromise IOCs collected from dynamic analysis of 21 samples Registry Keys Occurrences <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: LanguageList 5 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS Value Name: Startup 2 <HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E Value Name: @explorer.exe,-7001 1
Mutexes Occurrences MSCTF.Asm.{00000009-1cb50e6c-089e-d5d99e-08d9da5805ba}4 Random name4 Global\MSCTF.Asm.{1cb50e6c-089e-d5d9-9e08-d9da5805ba7f}4 Session\1\MSCTF.Asm.{1cb50e6c-089e-d5d9-9e08-d9da5805ba7f}4 Session\2\MSCTF.Asm.{1cb50e6c-089e-d5d9-9e08-d9da5805ba7f}4 Session\3\MSCTF.Asm.{1cb50e6c-089e-d5d9-9e08-d9da5805ba7f}4 Session\4\MSCTF.Asm.{1cb50e6c-089e-d5d9-9e08-d9da5805ba7f}4 Session\5\MSCTF.Asm.{1cb50e6c-089e-d5d9-9e08-d9da5805ba7f}4 Session\6\MSCTF.Asm.{1cb50e6c-089e-d5d9-9e08-d9da5805ba7f}4 Session\7\MSCTF.Asm.{1cb50e6c-089e-d5d9-9e08-d9da5805ba7f}4 Session\8\MSCTF.Asm.{1cb50e6c-089e-d5d9-9e08-d9da5805ba7f}4 80b59841e5c6230bb2c2395854fd58ec2 3d2ace6bf496d0362e6311d6f3ab2f722
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 185[.]145[.]245[.]1244 176[.]113[.]115[.]2012
Files and or directories created Occurrences %APPDATA%\80b59841e5c6232 %APPDATA%\80b59841e5c623\cred64.dll2 %TEMP%\b667dbdcd82 %TEMP%\b667dbdcd8\rovwer.exe2 %System32%\Tasks\rovwer.exe2 \{76ad8643-0fa0-8a34-e3e6-855ab584454b}2 \{bfcdf716-5376-3d0b-37b8-f83bc96ca105}1 \{4feb3bef-c8f9-d16c-dfb8-933e58354094}1 %APPDATA%\nsis_uns6586659e.dll1 %APPDATA%\nsis_uns6586683c.dll1 %APPDATA%\nsis_uns6586688a.dll1 %APPDATA%\nsis_uns658666c6.dll1
File Hashes 01ef4643d1e6b32b776171f9ec4cd10b106df2d9a3afd82b174853f5527f4266 0b33b93e1503e4bbfbc7663d3357258f82b3f7ccaf4ba5c8f8353b42b5430d80 1297db9855e033cf1c70e8fb96bc291f7d7c74ae5d00c4f70ecdde7f2057aa54 29257b30851aa0df37a1269dcf77e9ba8b3cd2912d756ade0e79e0c8db55b3fc 2f1c704a20e3c7c5be880100c738b41d7de78ff04afc57535fff5d214a398deb 378e3a598411255a14dbacfcffc5960fe0d23aec0b3dd663d1911e24788da102 5dce0bc4ba91282cf1d3d27b9ded68aceee6cbbe58ae9981e251dc8b14736fff 68cd610e711daa31bd85fc81f5a7dfa50d618d411f7467d002857d95b666c0dc 7f88baec6154d6732b3e13cd276c7441e8f37ab3f35aa523d94abc2b4c919585 84320852144e6e6ce1ac0b0c55befd0a12d6a54a30de8d08fa917b7eae359a21 8f9bf2229781003441216a27f9df7d0777de8a7feea2f556ea814947dfc9d475 9fa86bc700a7300a5d4d93dd0cb71bed89caf84a4b083ef2df7018bc2af8c5f5 a4b16a87e46909a520a164c53b224a0d37a885a0739d943123b4d344e30ca394 aaf12c7de031abcec3aa0b0600d5c01f6e630a4a3efddc0237e5438b7d968811 b8b36f9b4df37140b223bf5231e8c8ee77f8f7626e6d2d07e402b427d398e52d dc0890d6cb1ef700bc2f34d1ae3c4ffb30a7456240a1cfbb3e6cccd4f5c516ce e3851ff15b556b1a8151c2affd2206710b5cc3f399b994a929d847ebb083c5d9 e4081543d232f6f966b7d54ac6c5d2e8a69395104737fe1e770ee96c3c47c0f9 f5e4d8fd09515cc543fe9e0743e8231eb343402045ac0979de9b67c7b30c6905 f9cbf22948c123667716f8635fe7dd706241b4437446a90db98847041c659a71 fc4172d3f52ab6d0e8cff6ba1690b82d3315b76d72ab6ba78df012470d215ec0
Coverage Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella N/A WSA
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK
