Threat Roundup for November 5 to November 12
Tagsransomware
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | 249.5.55.69.bl.spamcop.net | ted by malware. Does not indicate maliciousness Occurrences 249[.]5[.]55[.]69[.]bl[.]spamcop[.]net 56 249[.]5[.]55[.]69[.]cbl[.]abuseat[.]org 56 2 |
| domain | 249.5.55.69.cbl.abuseat.org | sness Occurrences 249[.]5[.]55[.]69[.]bl[.]spamcop[.]net 56 249[.]5[.]55[.]69[.]cbl[.]abuseat[.]org 56 249[.]5[.]55[.]69[.]dnsbl[.]sorbs[.]net 56 2 |
| domain | 249.5.55.69.dnsbl.sorbs.net | spamcop[.]net 56 249[.]5[.]55[.]69[.]cbl[.]abuseat[.]org 56 249[.]5[.]55[.]69[.]dnsbl[.]sorbs[.]net 56 249[.]5[.]55[.]69[.]in-addr[.]arpa 56 249[.] |
| domain | 249.5.55.69.in-addr.arpa | abuseat[.]org 56 249[.]5[.]55[.]69[.]dnsbl[.]sorbs[.]net 56 249[.]5[.]55[.]69[.]in-addr[.]arpa 56 249[.]5[.]55[.]69[.]sbl-xbl[.]spamhaus[.]org 5 |
| domain | 249.5.55.69.sbl-xbl.spamhaus.org | nsbl[.]sorbs[.]net 56 249[.]5[.]55[.]69[.]in-addr[.]arpa 56 249[.]5[.]55[.]69[.]sbl-xbl[.]spamhaus[.]org 56 249[.]5[.]55[.]69[.]zen[.]spamhaus[.]org 56 |
| domain | 249.5.55.69.zen.spamhaus.org | r[.]arpa 56 249[.]5[.]55[.]69[.]sbl-xbl[.]spamhaus[.]org 56 249[.]5[.]55[.]69[.]zen[.]spamhaus[.]org 56 microsoft-com[.]mail[.]protection[.]outlook[ |
| domain | afoctlamhq.in | .]pw 1 arlllswc[.]com 1 gjyttpvb[.]net 1 ytfalkcclaw[.]in 1 afoctlamhq[.]in 1 *See JSON for more IOCs Files and or directories create |
| domain | al-ip4-mx-vip1.prodigy.net | a[.]org 54 www[.]instagram[.]com 53 mail[.]h-email[.]net 50 al-ip4-mx-vip1[.]prodigy[.]net 50 mx1[.]naver[.]com 49 park-mx[.]above[.]com 49 mx1[.] |
| domain | arlllswc.com | om 4 wpad[.]example[.]org 4 neolx[.]com 1 rqdptmnlyy[.]pw 1 arlllswc[.]com 1 gjyttpvb[.]net 1 ytfalkcclaw[.]in 1 afoctlamhq[.]in 1 * |
| domain | aspmx.l.google.com | 56 microsoft[.]com 56 www[.]google[.]com 56 quadoil[.]ru 56 aspmx[.]l[.]google[.]com 55 whois[.]arin[.]net 54 whois[.]iana[.]org 54 www[.] |
| domain | clientconfig.passport.net | org 1 vmss-prod-weu[.]westeurope[.]cloudapp[.]azure[.]com 1 clientconfig[.]passport[.]net 1 Files and or directories created Occurrences %APPDATA |
| domain | computer.example.org | ss Occurrences ru[.]agulino[.]com 17 wpad[.]example[.]org 2 computer[.]example[.]org 1 vmss-prod-weu[.]westeurope[.]cloudapp[.]azure[.]com 1 |
| domain | emcqaelhfn.pw | lu[.]pw 23 phgrcrm[.]net 23 qbpqbucz[.]in 23 hdrqny[.]pw 23 emcqaelhfn[.]pw 23 www[.]msftncsi[.]com 4 wpad[.]example[.]org 4 neolx[.] |
| domain | gjlngkx.net | 23 nckynkrjg[.]in 23 xxrwudfhbr[.]net 23 iuojcbwlb[.]in 23 gjlngkx[.]net 23 nmovreiit[.]in 23 gpuxnhtdhztg[.]in 23 xpbyti[.]pw 23 |
| domain | gjyttpvb.net | le[.]org 4 neolx[.]com 1 rqdptmnlyy[.]pw 1 arlllswc[.]com 1 gjyttpvb[.]net 1 ytfalkcclaw[.]in 1 afoctlamhq[.]in 1 *See JSON for more |
| domain | google.com | s not indicate maliciousness Occurrences microsoft[.]com 23 google[.]com 23 hkzqekcz[.]net 23 zrailjorqed[.]pw 23 nckynkrjg[.]in 2 |
| domain | gpuxnhtdhztg.in | net 23 iuojcbwlb[.]in 23 gjlngkx[.]net 23 nmovreiit[.]in 23 gpuxnhtdhztg[.]in 23 xpbyti[.]pw 23 nlaoyufe[.]in 23 syffllqlu[.]pw 23 phgr |
| domain | hanmail.net | t 49 mx-aol[.]mail[.]gm0[.]yahoodns[.]net 48 naver[.]com 48 hanmail[.]net 47 mx00[.]mail[.]com 47 www[.]youtube[.]com 46 nate[.]com |
| domain | hdrqny.pw | .]in 23 syffllqlu[.]pw 23 phgrcrm[.]net 23 qbpqbucz[.]in 23 hdrqny[.]pw 23 emcqaelhfn[.]pw 23 www[.]msftncsi[.]com 4 wpad[.]examp |
| domain | hkzqekcz.net | aliciousness Occurrences microsoft[.]com 23 google[.]com 23 hkzqekcz[.]net 23 zrailjorqed[.]pw 23 nckynkrjg[.]in 23 xxrwudfhbr[.]net |
| domain | iuojcbwlb.in | 3 zrailjorqed[.]pw 23 nckynkrjg[.]in 23 xxrwudfhbr[.]net 23 iuojcbwlb[.]in 23 gjlngkx[.]net 23 nmovreiit[.]in 23 gpuxnhtdhztg[.]in 2 |
| domain | mail.h-email.net | rin[.]net 54 whois[.]iana[.]org 54 www[.]instagram[.]com 53 mail[.]h-email[.]net 50 al-ip4-mx-vip1[.]prodigy[.]net 50 mx1[.]naver[.]com |
| domain | microsoft.com | org 56 microsoft-com[.]mail[.]protection[.]outlook[.]com 56 microsoft[.]com 56 www[.]google[.]com 56 quadoil[.]ru 56 aspmx[.]l[.]goog |
| domain | microsoft-com.mail.protection.outlook.com | amhaus[.]org 56 249[.]5[.]55[.]69[.]zen[.]spamhaus[.]org 56 microsoft-com[.]mail[.]protection[.]outlook[.]com 56 microsoft[.]com 56 www[.]google[.]com 56 quadoil |
| domain | mx00.mail.com | l[.]gm0[.]yahoodns[.]net 48 naver[.]com 48 hanmail[.]net 47 mx00[.]mail[.]com 47 www[.]youtube[.]com 46 nate[.]com 46 *See JSON for m |
| domain | mx1.hanmail.net | digy[.]net 50 mx1[.]naver[.]com 49 park-mx[.]above[.]com 49 mx1[.]hanmail[.]net 49 mx-aol[.]mail[.]gm0[.]yahoodns[.]net 48 naver[.]com |
| domain | mx1.naver.com | 3 mail[.]h-email[.]net 50 al-ip4-mx-vip1[.]prodigy[.]net 50 mx1[.]naver[.]com 49 park-mx[.]above[.]com 49 mx1[.]hanmail[.]net 49 mx-a |
| domain | mx-aol.mail.gm0.yahoodns.net | er[.]com 49 park-mx[.]above[.]com 49 mx1[.]hanmail[.]net 49 mx-aol[.]mail[.]gm0[.]yahoodns[.]net 48 naver[.]com 48 hanmail[.]net 47 mx00[.]mail[.]co |
| domain | nate.com | anmail[.]net 47 mx00[.]mail[.]com 47 www[.]youtube[.]com 46 nate[.]com 46 *See JSON for more IOCs Files and or directories creat |
| domain | naver.com | [.]hanmail[.]net 49 mx-aol[.]mail[.]gm0[.]yahoodns[.]net 48 naver[.]com 48 hanmail[.]net 47 mx00[.]mail[.]com 47 www[.]youtube[.] |
| domain | nckynkrjg.in | om 23 google[.]com 23 hkzqekcz[.]net 23 zrailjorqed[.]pw 23 nckynkrjg[.]in 23 xxrwudfhbr[.]net 23 iuojcbwlb[.]in 23 gjlngkx[.]net 23 |
| domain | neolx.com | elhfn[.]pw 23 www[.]msftncsi[.]com 4 wpad[.]example[.]org 4 neolx[.]com 1 rqdptmnlyy[.]pw 1 arlllswc[.]com 1 gjyttpvb[.]net 1 ytf |
| domain | nlaoyufe.in | et 23 nmovreiit[.]in 23 gpuxnhtdhztg[.]in 23 xpbyti[.]pw 23 nlaoyufe[.]in 23 syffllqlu[.]pw 23 phgrcrm[.]net 23 qbpqbucz[.]in 23 hd |
| domain | nmovreiit.in | n 23 xxrwudfhbr[.]net 23 iuojcbwlb[.]in 23 gjlngkx[.]net 23 nmovreiit[.]in 23 gpuxnhtdhztg[.]in 23 xpbyti[.]pw 23 nlaoyufe[.]in 23 s |
| domain | park-mx.above.com | t 50 al-ip4-mx-vip1[.]prodigy[.]net 50 mx1[.]naver[.]com 49 park-mx[.]above[.]com 49 mx1[.]hanmail[.]net 49 mx-aol[.]mail[.]gm0[.]yahoodn |
| domain | phgrcrm.net | g[.]in 23 xpbyti[.]pw 23 nlaoyufe[.]in 23 syffllqlu[.]pw 23 phgrcrm[.]net 23 qbpqbucz[.]in 23 hdrqny[.]pw 23 emcqaelhfn[.]pw 23 www |
| domain | qbpqbucz.in | .]pw 23 nlaoyufe[.]in 23 syffllqlu[.]pw 23 phgrcrm[.]net 23 qbpqbucz[.]in 23 hdrqny[.]pw 23 emcqaelhfn[.]pw 23 www[.]msftncsi[.]com |
| domain | quadoil.ru | .]outlook[.]com 56 microsoft[.]com 56 www[.]google[.]com 56 quadoil[.]ru 56 aspmx[.]l[.]google[.]com 55 whois[.]arin[.]net 54 whoi |
| domain | rqdptmnlyy.pw | www[.]msftncsi[.]com 4 wpad[.]example[.]org 4 neolx[.]com 1 rqdptmnlyy[.]pw 1 arlllswc[.]com 1 gjyttpvb[.]net 1 ytfalkcclaw[.]in 1 af |
| domain | ru.agulino.com | ted by malware. Does not indicate maliciousness Occurrences ru[.]agulino[.]com 17 wpad[.]example[.]org 2 computer[.]example[.]org 1 vm |
| domain | syffllqlu.pw | ]in 23 gpuxnhtdhztg[.]in 23 xpbyti[.]pw 23 nlaoyufe[.]in 23 syffllqlu[.]pw 23 phgrcrm[.]net 23 qbpqbucz[.]in 23 hdrqny[.]pw 23 emcqa |
| domain | vmss-prod-weu.westeurope.cloudapp.azure.com | [.]com 17 wpad[.]example[.]org 2 computer[.]example[.]org 1 vmss-prod-weu[.]westeurope[.]cloudapp[.]azure[.]com 1 clientconfig[.]passport[.]net 1 Files and or dire |
| domain | whois.arin.net | google[.]com 56 quadoil[.]ru 56 aspmx[.]l[.]google[.]com 55 whois[.]arin[.]net 54 whois[.]iana[.]org 54 www[.]instagram[.]com 53 mail[ |
| domain | whois.iana.org | l[.]ru 56 aspmx[.]l[.]google[.]com 55 whois[.]arin[.]net 54 whois[.]iana[.]org 54 www[.]instagram[.]com 53 mail[.]h-email[.]net 50 al- |
| domain | wpad.example.org | ot indicate maliciousness Occurrences ru[.]agulino[.]com 17 wpad[.]example[.]org 2 computer[.]example[.]org 1 vmss-prod-weu[.]westeurope |
| domain | www.google.com | m[.]mail[.]protection[.]outlook[.]com 56 microsoft[.]com 56 www[.]google[.]com 56 quadoil[.]ru 56 aspmx[.]l[.]google[.]com 55 whois[.] |
| domain | www.instagram.com | google[.]com 55 whois[.]arin[.]net 54 whois[.]iana[.]org 54 www[.]instagram[.]com 53 mail[.]h-email[.]net 50 al-ip4-mx-vip1[.]prodigy[.]n |
| domain | www.msftncsi.com | .]net 23 qbpqbucz[.]in 23 hdrqny[.]pw 23 emcqaelhfn[.]pw 23 www[.]msftncsi[.]com 4 wpad[.]example[.]org 4 neolx[.]com 1 rqdptmnlyy[.]pw |
| domain | www.youtube.com | net 48 naver[.]com 48 hanmail[.]net 47 mx00[.]mail[.]com 47 www[.]youtube[.]com 46 nate[.]com 46 *See JSON for more IOCs Files and or d |
| domain | xpbyti.pw | 23 gjlngkx[.]net 23 nmovreiit[.]in 23 gpuxnhtdhztg[.]in 23 xpbyti[.]pw 23 nlaoyufe[.]in 23 syffllqlu[.]pw 23 phgrcrm[.]net 23 qb |
| domain | xxrwudfhbr.net | 23 hkzqekcz[.]net 23 zrailjorqed[.]pw 23 nckynkrjg[.]in 23 xxrwudfhbr[.]net 23 iuojcbwlb[.]in 23 gjlngkx[.]net 23 nmovreiit[.]in 23 g |
| domain | ytfalkcclaw.in | .]com 1 rqdptmnlyy[.]pw 1 arlllswc[.]com 1 gjyttpvb[.]net 1 ytfalkcclaw[.]in 1 afoctlamhq[.]in 1 *See JSON for more IOCs Files and or |
| domain | zrailjorqed.pw | rences microsoft[.]com 23 google[.]com 23 hkzqekcz[.]net 23 zrailjorqed[.]pw 23 nckynkrjg[.]in 23 xxrwudfhbr[.]net 23 iuojcbwlb[.]in 2 |
| sha256 | 000bea950f66052cf937547d1f18bc47a1c6ff6d2d7d03bc09d60aa9c9b1c770 | \Local Settings\Application Data\efcggqxj.exe 1 File Hashes 000bea950f66052cf937547d1f18bc47a1c6ff6d2d7d03bc09d60aa9c9b1c770 00e8fa17d90f77afadd8f255dca53b15d7f4c91719452d616b0cf663f9a |
| sha256 | 00e8fa17d90f77afadd8f255dca53b15d7f4c91719452d616b0cf663f9aeea99 | a950f66052cf937547d1f18bc47a1c6ff6d2d7d03bc09d60aa9c9b1c770 00e8fa17d90f77afadd8f255dca53b15d7f4c91719452d616b0cf663f9aeea99 033755fcc85dad80db7a94ea2dc178dc2cc823fe7b46084fd0ed20645b5 |
| sha256 | 0116e2cc42cc67d4ee0fbd26b113a2883c9ef920dc84bb7ab622d1bf8851763f | cal\Temp\yvgljtqn.exe 1 *See JSON for more IOCs File Hashes 0116e2cc42cc67d4ee0fbd26b113a2883c9ef920dc84bb7ab622d1bf8851763f 02c7359dcb84754d1582eab7ef5f16938ee9cf88a83d150c1470a6b3b24 |
| sha256 | 02c7359dcb84754d1582eab7ef5f16938ee9cf88a83d150c1470a6b3b24bf31c | 2cc42cc67d4ee0fbd26b113a2883c9ef920dc84bb7ab622d1bf8851763f 02c7359dcb84754d1582eab7ef5f16938ee9cf88a83d150c1470a6b3b24bf31c 03fb15b85a5b40369f8e392427ea5f004447c90273b01ccbcbdff27d0fd |
| sha256 | 033755fcc85dad80db7a94ea2dc178dc2cc823fe7b46084fd0ed20645b593290 | a17d90f77afadd8f255dca53b15d7f4c91719452d616b0cf663f9aeea99 033755fcc85dad80db7a94ea2dc178dc2cc823fe7b46084fd0ed20645b593290 037e90d5a83ea1360c1c74b34e3d648ba8645b32d9de456756e8ba6acac |
| sha256 | 037e90d5a83ea1360c1c74b34e3d648ba8645b32d9de456756e8ba6acac86d6d | 5fcc85dad80db7a94ea2dc178dc2cc823fe7b46084fd0ed20645b593290 037e90d5a83ea1360c1c74b34e3d648ba8645b32d9de456756e8ba6acac86d6d 04c74fa81fdd718c985fde6a502f1ed93a0d34255dc21b546fcc25425da |
| sha256 | 03eee9c470a2987fe0a045530c2efd0bbbab9eeb5b91a893e682cf144e252107 | ocal\Temp\WER3F6C.tmp.WERInternalMetadata.xml 1 File Hashes 03eee9c470a2987fe0a045530c2efd0bbbab9eeb5b91a893e682cf144e252107 18e5a593d4a89648b43f86383568469612c4f61d4b8361df299e1fdbe9a |
| sha256 | 03fb15b85a5b40369f8e392427ea5f004447c90273b01ccbcbdff27d0fd5620b | 59dcb84754d1582eab7ef5f16938ee9cf88a83d150c1470a6b3b24bf31c 03fb15b85a5b40369f8e392427ea5f004447c90273b01ccbcbdff27d0fd5620b 0c4c84401bc57951c1add588817d96cae70469c0ad699b2c154855a730c |
| sha256 | 04c74fa81fdd718c985fde6a502f1ed93a0d34255dc21b546fcc25425da9f31e | 0d5a83ea1360c1c74b34e3d648ba8645b32d9de456756e8ba6acac86d6d 04c74fa81fdd718c985fde6a502f1ed93a0d34255dc21b546fcc25425da9f31e 086985abecc0ee9c6b4caa28e74d3190994dbddae40524eb955526ad5be |
| sha256 | 086985abecc0ee9c6b4caa28e74d3190994dbddae40524eb955526ad5be9f067 | fa81fdd718c985fde6a502f1ed93a0d34255dc21b546fcc25425da9f31e 086985abecc0ee9c6b4caa28e74d3190994dbddae40524eb955526ad5be9f067 08de3a669a95eab65d9b95ecf7ed4085e162badd7b11b3ad126be4d9836 |
| sha256 | 08de3a669a95eab65d9b95ecf7ed4085e162badd7b11b3ad126be4d9836d33e4 | 5abecc0ee9c6b4caa28e74d3190994dbddae40524eb955526ad5be9f067 08de3a669a95eab65d9b95ecf7ed4085e162badd7b11b3ad126be4d9836d33e4 1ba2d5d15ede307fa5a969eb66654f4d485fc144e370531451c43dc6409 |
| sha256 | 0c4c84401bc57951c1add588817d96cae70469c0ad699b2c154855a730cf8afa | 5b85a5b40369f8e392427ea5f004447c90273b01ccbcbdff27d0fd5620b 0c4c84401bc57951c1add588817d96cae70469c0ad699b2c154855a730cf8afa 11bb33bf6c4dcf920e28a36b061353e87e314236faebe4563c3fa5c8772 |
| sha256 | 11bb33bf6c4dcf920e28a36b061353e87e314236faebe4563c3fa5c877230404 | 4401bc57951c1add588817d96cae70469c0ad699b2c154855a730cf8afa 11bb33bf6c4dcf920e28a36b061353e87e314236faebe4563c3fa5c877230404 158001d30d5d3768e6fe0f1a1d7bf1ad0da65241a6f01196150b5cf8a52 |
| sha256 | 158001d30d5d3768e6fe0f1a1d7bf1ad0da65241a6f01196150b5cf8a52b9623 | 3bf6c4dcf920e28a36b061353e87e314236faebe4563c3fa5c877230404 158001d30d5d3768e6fe0f1a1d7bf1ad0da65241a6f01196150b5cf8a52b9623 1d5f62d3687343709946d1bf46ed5e91b4659e376261a499722cf071d14 |
| sha256 | 18e5a593d4a89648b43f86383568469612c4f61d4b8361df299e1fdbe9ac42f5 | 9c470a2987fe0a045530c2efd0bbbab9eeb5b91a893e682cf144e252107 18e5a593d4a89648b43f86383568469612c4f61d4b8361df299e1fdbe9ac42f5 34c862548b46506e25df6187be15486a2bc0de85b7e2b02b12745df7145 |
| sha256 | 1ba2d5d15ede307fa5a969eb66654f4d485fc144e370531451c43dc6409737d9 | a669a95eab65d9b95ecf7ed4085e162badd7b11b3ad126be4d9836d33e4 1ba2d5d15ede307fa5a969eb66654f4d485fc144e370531451c43dc6409737d9 1f18d7fcd14fa41d8256a373437ccfd3e0d0d4f80c41daeda99cfd49373 |
| sha256 | 1d5f62d3687343709946d1bf46ed5e91b4659e376261a499722cf071d14a2e32 | 1d30d5d3768e6fe0f1a1d7bf1ad0da65241a6f01196150b5cf8a52b9623 1d5f62d3687343709946d1bf46ed5e91b4659e376261a499722cf071d14a2e32 20db1c12886f165778eaabff78196c7166b43b18767d802373150408870 |
| sha256 | 1f18d7fcd14fa41d8256a373437ccfd3e0d0d4f80c41daeda99cfd493735acc8 | 5d15ede307fa5a969eb66654f4d485fc144e370531451c43dc6409737d9 1f18d7fcd14fa41d8256a373437ccfd3e0d0d4f80c41daeda99cfd493735acc8 1fb1390e6f86cc5eb108a6a38484fa91baf867622e7384d4777b7b12215 |
| sha256 | 1fb1390e6f86cc5eb108a6a38484fa91baf867622e7384d4777b7b12215cab8c | 7fcd14fa41d8256a373437ccfd3e0d0d4f80c41daeda99cfd493735acc8 1fb1390e6f86cc5eb108a6a38484fa91baf867622e7384d4777b7b12215cab8c 27862adbd6ba16a82915102b7cfbf36f25c7be6b7e0464a7bcd731c9c5c |
| sha256 | 20db1c12886f165778eaabff78196c7166b43b18767d802373150408870b7d99 | 2d3687343709946d1bf46ed5e91b4659e376261a499722cf071d14a2e32 20db1c12886f165778eaabff78196c7166b43b18767d802373150408870b7d99 2a6ff1d92b275b5479f724cacbef20a3757227d7bf7f943c5a91609a370 |
| sha256 | 27862adbd6ba16a82915102b7cfbf36f25c7be6b7e0464a7bcd731c9c5c67316 | 90e6f86cc5eb108a6a38484fa91baf867622e7384d4777b7b12215cab8c 27862adbd6ba16a82915102b7cfbf36f25c7be6b7e0464a7bcd731c9c5c67316 36971d72adc866b317be68ddf5b3471825049a81231b53c5cfdacb292d4 |
| sha256 | 2a6ff1d92b275b5479f724cacbef20a3757227d7bf7f943c5a91609a370cf006 | c12886f165778eaabff78196c7166b43b18767d802373150408870b7d99 2a6ff1d92b275b5479f724cacbef20a3757227d7bf7f943c5a91609a370cf006 2aa24f0c26531e9222de7e2ce6f0453e0465a6545ac7accb5f9ffc1983f |
| sha256 | 2aa24f0c26531e9222de7e2ce6f0453e0465a6545ac7accb5f9ffc1983fa4f9d | 1d92b275b5479f724cacbef20a3757227d7bf7f943c5a91609a370cf006 2aa24f0c26531e9222de7e2ce6f0453e0465a6545ac7accb5f9ffc1983fa4f9d 2ee90707f21676ebaf7e821bf02f24d56d1a7be273c8aa129eb60cacd09 |
| sha256 | 2ee90707f21676ebaf7e821bf02f24d56d1a7be273c8aa129eb60cacd09f19df | f0c26531e9222de7e2ce6f0453e0465a6545ac7accb5f9ffc1983fa4f9d 2ee90707f21676ebaf7e821bf02f24d56d1a7be273c8aa129eb60cacd09f19df 2fbb49dd038c61306b7c32663dcf6f6f5545b1538c90464c148980c69f4 |
| sha256 | 2fbb49dd038c61306b7c32663dcf6f6f5545b1538c90464c148980c69f4331b3 | 707f21676ebaf7e821bf02f24d56d1a7be273c8aa129eb60cacd09f19df 2fbb49dd038c61306b7c32663dcf6f6f5545b1538c90464c148980c69f4331b3 322f25513dc717ec609771e4988d5a962dd5b980bc4bf372d206ab991c0 |
| sha256 | 322f25513dc717ec609771e4988d5a962dd5b980bc4bf372d206ab991c092382 | 9dd038c61306b7c32663dcf6f6f5545b1538c90464c148980c69f4331b3 322f25513dc717ec609771e4988d5a962dd5b980bc4bf372d206ab991c092382 345af13820aaefd07456b97821b597c8c020c907541e25c32f304c4a1a3 |
| sha256 | 345af13820aaefd07456b97821b597c8c020c907541e25c32f304c4a1a3f324a | 5513dc717ec609771e4988d5a962dd5b980bc4bf372d206ab991c092382 345af13820aaefd07456b97821b597c8c020c907541e25c32f304c4a1a3f324a 348d21e49e7bad86d434423c8052dd72bb27d9a9f43d6b2471a1063261c |
| sha256 | 348d21e49e7bad86d434423c8052dd72bb27d9a9f43d6b2471a1063261c69c35 | 13820aaefd07456b97821b597c8c020c907541e25c32f304c4a1a3f324a 348d21e49e7bad86d434423c8052dd72bb27d9a9f43d6b2471a1063261c69c35 354f4a167b2bbdbdd1e8d36f26c4524f1454abb79e745c1a0a3945e9bb1 |
| sha256 | 34c862548b46506e25df6187be15486a2bc0de85b7e2b02b12745df7145faf5d | 593d4a89648b43f86383568469612c4f61d4b8361df299e1fdbe9ac42f5 34c862548b46506e25df6187be15486a2bc0de85b7e2b02b12745df7145faf5d 56d50fb071eb481a83ae011eb7a31fd6bee268fba1b0fe7aa880f6a108f |
| sha256 | 354f4a167b2bbdbdd1e8d36f26c4524f1454abb79e745c1a0a3945e9bb1ddeef | 1e49e7bad86d434423c8052dd72bb27d9a9f43d6b2471a1063261c69c35 354f4a167b2bbdbdd1e8d36f26c4524f1454abb79e745c1a0a3945e9bb1ddeef 35b7bbf1581e93fad329c50307ae2f68964bf8866e437d308c56eda819a |
| sha256 | 35b7bbf1581e93fad329c50307ae2f68964bf8866e437d308c56eda819acb8d7 | a167b2bbdbdd1e8d36f26c4524f1454abb79e745c1a0a3945e9bb1ddeef 35b7bbf1581e93fad329c50307ae2f68964bf8866e437d308c56eda819acb8d7 40bfcd3518b19ded7d92a6930ab6e410002c333fe327044800599a95ee6 |
| sha256 | 36971d72adc866b317be68ddf5b3471825049a81231b53c5cfdacb292d49b4d6 | adbd6ba16a82915102b7cfbf36f25c7be6b7e0464a7bcd731c9c5c67316 36971d72adc866b317be68ddf5b3471825049a81231b53c5cfdacb292d49b4d6 39781b0d4b88226ae7cc4711c9d4724ee9010e9f543be7fbd3d31564d89 |
| sha256 | 39781b0d4b88226ae7cc4711c9d4724ee9010e9f543be7fbd3d31564d89546dd | d72adc866b317be68ddf5b3471825049a81231b53c5cfdacb292d49b4d6 39781b0d4b88226ae7cc4711c9d4724ee9010e9f543be7fbd3d31564d89546dd 3a36245e815538d2f84d05af6b1d71f81dd9c284cac1c0ceb2145d9f1bb |
| sha256 | 3a36245e815538d2f84d05af6b1d71f81dd9c284cac1c0ceb2145d9f1bb9a7e9 | b0d4b88226ae7cc4711c9d4724ee9010e9f543be7fbd3d31564d89546dd 3a36245e815538d2f84d05af6b1d71f81dd9c284cac1c0ceb2145d9f1bb9a7e9 3ca7c310670af06b7e57e5317283e03c2aa630b72f2d99f93734d960bf1 |
| sha256 | 3ca7c310670af06b7e57e5317283e03c2aa630b72f2d99f93734d960bf19040b | 45e815538d2f84d05af6b1d71f81dd9c284cac1c0ceb2145d9f1bb9a7e9 3ca7c310670af06b7e57e5317283e03c2aa630b72f2d99f93734d960bf19040b 40023d8e643d0c49199f1d34beb4c79856f30cc155ff8f93300b9cca70a |
| sha256 | 40023d8e643d0c49199f1d34beb4c79856f30cc155ff8f93300b9cca70affb0c | 310670af06b7e57e5317283e03c2aa630b72f2d99f93734d960bf19040b 40023d8e643d0c49199f1d34beb4c79856f30cc155ff8f93300b9cca70affb0c 410c8127cf6d7bac2cb13d84dd8415aabc5831bdb617b49e8d28d024db9 |
| sha256 | 40bfcd3518b19ded7d92a6930ab6e410002c333fe327044800599a95ee67e225 | bf1581e93fad329c50307ae2f68964bf8866e437d308c56eda819acb8d7 40bfcd3518b19ded7d92a6930ab6e410002c333fe327044800599a95ee67e225 41f7a9f6f6ec0cd336288c833ba746c5d40dc7d49f3f5717e89d8dc7471 |
| sha256 | 410c8127cf6d7bac2cb13d84dd8415aabc5831bdb617b49e8d28d024db906c51 | d8e643d0c49199f1d34beb4c79856f30cc155ff8f93300b9cca70affb0c 410c8127cf6d7bac2cb13d84dd8415aabc5831bdb617b49e8d28d024db906c51 42ca7b17fa816bf7dfdee073fd077f2327e31ae15f386c087912757894e |
| sha256 | 41f7a9f6f6ec0cd336288c833ba746c5d40dc7d49f3f5717e89d8dc74714d478 | d3518b19ded7d92a6930ab6e410002c333fe327044800599a95ee67e225 41f7a9f6f6ec0cd336288c833ba746c5d40dc7d49f3f5717e89d8dc74714d478 4de8148701b1fe0a054b13829fb3763a8645b6468463de3e38f33526307 |
| sha256 | 42ca7b17fa816bf7dfdee073fd077f2327e31ae15f386c087912757894e2ac0a | 127cf6d7bac2cb13d84dd8415aabc5831bdb617b49e8d28d024db906c51 42ca7b17fa816bf7dfdee073fd077f2327e31ae15f386c087912757894e2ac0a 44837ce7705a1c03338d220d186564930bcb1e739af90f04cd415b37b57 |
| sha256 | 44837ce7705a1c03338d220d186564930bcb1e739af90f04cd415b37b5719b90 | b17fa816bf7dfdee073fd077f2327e31ae15f386c087912757894e2ac0a 44837ce7705a1c03338d220d186564930bcb1e739af90f04cd415b37b5719b90 48179cd3f777d239fb1f14ac8ed1472dd8c9dec65414b92953b5d67faad |
| sha256 | 48179cd3f777d239fb1f14ac8ed1472dd8c9dec65414b92953b5d67faad4f9b7 | ce7705a1c03338d220d186564930bcb1e739af90f04cd415b37b5719b90 48179cd3f777d239fb1f14ac8ed1472dd8c9dec65414b92953b5d67faad4f9b7 50fd2544836d5623d86f94307583fe7a4c88b11cdaa84f3f6b5a03a8631 |
| sha256 | 4de8148701b1fe0a054b13829fb3763a8645b6468463de3e38f33526307f9e8b | 9f6f6ec0cd336288c833ba746c5d40dc7d49f3f5717e89d8dc74714d478 4de8148701b1fe0a054b13829fb3763a8645b6468463de3e38f33526307f9e8b 5d21753e0586d127c06cde17551bd702e449dfa8a4aca6ff1116251ff1f |
| sha256 | 50fd2544836d5623d86f94307583fe7a4c88b11cdaa84f3f6b5a03a8631e8c0a | cd3f777d239fb1f14ac8ed1472dd8c9dec65414b92953b5d67faad4f9b7 50fd2544836d5623d86f94307583fe7a4c88b11cdaa84f3f6b5a03a8631e8c0a 64d3d27a53d3cde1729f8897a09aac19557121ede477e4a1d18a86ef33b |
| sha256 | 56d50fb071eb481a83ae011eb7a31fd6bee268fba1b0fe7aa880f6a108f9f682 | 2548b46506e25df6187be15486a2bc0de85b7e2b02b12745df7145faf5d 56d50fb071eb481a83ae011eb7a31fd6bee268fba1b0fe7aa880f6a108f9f682 5bdaafdaeb1ad0f8455de525022d95d40362d2766e78bd9eeecf7acf342 |
| sha256 | 5bdaafdaeb1ad0f8455de525022d95d40362d2766e78bd9eeecf7acf3426564e | fb071eb481a83ae011eb7a31fd6bee268fba1b0fe7aa880f6a108f9f682 5bdaafdaeb1ad0f8455de525022d95d40362d2766e78bd9eeecf7acf3426564e 666fdac0254a22535178f4cc056de7c43372359a1a9fc83c9b558770d27 |
| sha256 | 5d21753e0586d127c06cde17551bd702e449dfa8a4aca6ff1116251ff1fe7177 | 48701b1fe0a054b13829fb3763a8645b6468463de3e38f33526307f9e8b 5d21753e0586d127c06cde17551bd702e449dfa8a4aca6ff1116251ff1fe7177 5e6fb10b614e5ea6832ca853f3c43c4943499ac63097fd57c980babf7e7 |
| sha256 | 5e6fb10b614e5ea6832ca853f3c43c4943499ac63097fd57c980babf7e707cd4 | 53e0586d127c06cde17551bd702e449dfa8a4aca6ff1116251ff1fe7177 5e6fb10b614e5ea6832ca853f3c43c4943499ac63097fd57c980babf7e707cd4 5f5b0da28419c1a133e4949a129f2ae17db34fb3e64ce2c9dc84d91239c |
| sha256 | 5f5b0da28419c1a133e4949a129f2ae17db34fb3e64ce2c9dc84d91239c50082 | 10b614e5ea6832ca853f3c43c4943499ac63097fd57c980babf7e707cd4 5f5b0da28419c1a133e4949a129f2ae17db34fb3e64ce2c9dc84d91239c50082 5faa85eae77192413b213ae22e30a68a6e0b20e1c1d78a2663ed0c70a71 |
| sha256 | 5faa85eae77192413b213ae22e30a68a6e0b20e1c1d78a2663ed0c70a713be67 | da28419c1a133e4949a129f2ae17db34fb3e64ce2c9dc84d91239c50082 5faa85eae77192413b213ae22e30a68a6e0b20e1c1d78a2663ed0c70a713be67 61cbe9585ff80a96da97ce3afcaccce268b72d089ba88abc417642aa336 |
| sha256 | 61cbe9585ff80a96da97ce3afcaccce268b72d089ba88abc417642aa3365dddf | 5eae77192413b213ae22e30a68a6e0b20e1c1d78a2663ed0c70a713be67 61cbe9585ff80a96da97ce3afcaccce268b72d089ba88abc417642aa3365dddf *See JSON for more IOCs Coverage Product Protection Secure |
| sha256 | 64d3d27a53d3cde1729f8897a09aac19557121ede477e4a1d18a86ef33b2d675 | 544836d5623d86f94307583fe7a4c88b11cdaa84f3f6b5a03a8631e8c0a 64d3d27a53d3cde1729f8897a09aac19557121ede477e4a1d18a86ef33b2d675 656ee6200af32f34de24c591ebb45d5652f30a435ce84abb6c8c04cd91e |
| sha256 | 656ee6200af32f34de24c591ebb45d5652f30a435ce84abb6c8c04cd91e07500 | 27a53d3cde1729f8897a09aac19557121ede477e4a1d18a86ef33b2d675 656ee6200af32f34de24c591ebb45d5652f30a435ce84abb6c8c04cd91e07500 696629d6b4f9965ec8cf1cc9cefe973f907731e8c6fadd1189413d63f43 |
| sha256 | 666fdac0254a22535178f4cc056de7c43372359a1a9fc83c9b558770d278bc84 | fdaeb1ad0f8455de525022d95d40362d2766e78bd9eeecf7acf3426564e 666fdac0254a22535178f4cc056de7c43372359a1a9fc83c9b558770d278bc84 6be0f0991eebcdd021444994c3c812a89924b04b8ed27282e18b747305f |
| sha256 | 696629d6b4f9965ec8cf1cc9cefe973f907731e8c6fadd1189413d63f4390b30 | 6200af32f34de24c591ebb45d5652f30a435ce84abb6c8c04cd91e07500 696629d6b4f9965ec8cf1cc9cefe973f907731e8c6fadd1189413d63f4390b30 6a338dd0339ab184d2fa547e4a05b6cf94632dc3a03fb351ca703cea3f7 |
| sha256 | 6a338dd0339ab184d2fa547e4a05b6cf94632dc3a03fb351ca703cea3f7f2262 | 9d6b4f9965ec8cf1cc9cefe973f907731e8c6fadd1189413d63f4390b30 6a338dd0339ab184d2fa547e4a05b6cf94632dc3a03fb351ca703cea3f7f2262 *See JSON for more IOCs Coverage Product Protection Secure |
| sha256 | 6be0f0991eebcdd021444994c3c812a89924b04b8ed27282e18b747305f27bf7 | ac0254a22535178f4cc056de7c43372359a1a9fc83c9b558770d278bc84 6be0f0991eebcdd021444994c3c812a89924b04b8ed27282e18b747305f27bf7 71ca1ab8c327e81b97f9b93684f6a2f8de7b194f4d20b65bad89660fdb0 |
| sha256 | 71ca1ab8c327e81b97f9b93684f6a2f8de7b194f4d20b65bad89660fdb04982c | 0991eebcdd021444994c3c812a89924b04b8ed27282e18b747305f27bf7 71ca1ab8c327e81b97f9b93684f6a2f8de7b194f4d20b65bad89660fdb04982c 94c9c78a6d2e0b1808bbbde2a69f32464c74c8ad0f902b0a7aea75d443d |
| sha256 | 94c9c78a6d2e0b1808bbbde2a69f32464c74c8ad0f902b0a7aea75d443db1866 | ab8c327e81b97f9b93684f6a2f8de7b194f4d20b65bad89660fdb04982c 94c9c78a6d2e0b1808bbbde2a69f32464c74c8ad0f902b0a7aea75d443db1866 9523e53935a018bbe2a297ba95578a7e988a0a402eed2a97cf46a41f797 |
| sha256 | 9523e53935a018bbe2a297ba95578a7e988a0a402eed2a97cf46a41f797de971 | 78a6d2e0b1808bbbde2a69f32464c74c8ad0f902b0a7aea75d443db1866 9523e53935a018bbe2a297ba95578a7e988a0a402eed2a97cf46a41f797de971 9edb3091593479d03685b13b2eaa0104fb84bdc785c46cf70bb8e105e65 |
| sha256 | 9edb3091593479d03685b13b2eaa0104fb84bdc785c46cf70bb8e105e6589620 | 53935a018bbe2a297ba95578a7e988a0a402eed2a97cf46a41f797de971 9edb3091593479d03685b13b2eaa0104fb84bdc785c46cf70bb8e105e6589620 b46d16b74e5c430126372a5027108704074ebf5a87b1dc0634f41bc119b |
| sha256 | b46d16b74e5c430126372a5027108704074ebf5a87b1dc0634f41bc119b460dc | 091593479d03685b13b2eaa0104fb84bdc785c46cf70bb8e105e6589620 b46d16b74e5c430126372a5027108704074ebf5a87b1dc0634f41bc119b460dc c94368d73c897f193f7dd20d749d2348fa80f818d19b27888c28bc8e41c |
| sha256 | c94368d73c897f193f7dd20d749d2348fa80f818d19b27888c28bc8e41ccd262 | 6b74e5c430126372a5027108704074ebf5a87b1dc0634f41bc119b460dc c94368d73c897f193f7dd20d749d2348fa80f818d19b27888c28bc8e41ccd262 d3873c324768de351219c9e50a33cecc3d15ab568064591ff9857fff867 |
| sha256 | d3873c324768de351219c9e50a33cecc3d15ab568064591ff9857fff86780c76 | 8d73c897f193f7dd20d749d2348fa80f818d19b27888c28bc8e41ccd262 d3873c324768de351219c9e50a33cecc3d15ab568064591ff9857fff86780c76 e0e0854a4bcd7bb49292b001954e76ea3aaa8639839073e35a72adf88e3 |
| sha256 | e0e0854a4bcd7bb49292b001954e76ea3aaa8639839073e35a72adf88e3a25cc | c324768de351219c9e50a33cecc3d15ab568064591ff9857fff86780c76 e0e0854a4bcd7bb49292b001954e76ea3aaa8639839073e35a72adf88e3a25cc e1a572394b381e7ae7cca254ab171eb975f9e4e0be7480b01fb751be147 |
| sha256 | e1a572394b381e7ae7cca254ab171eb975f9e4e0be7480b01fb751be14712fe0 | 54a4bcd7bb49292b001954e76ea3aaa8639839073e35a72adf88e3a25cc e1a572394b381e7ae7cca254ab171eb975f9e4e0be7480b01fb751be14712fe0 ea1c77d4d703fe6825dfa9e406b84375384719f21f3250b93cd3e7550c6 |
| sha256 | ea1c77d4d703fe6825dfa9e406b84375384719f21f3250b93cd3e7550c685bec | 2394b381e7ae7cca254ab171eb975f9e4e0be7480b01fb751be14712fe0 ea1c77d4d703fe6825dfa9e406b84375384719f21f3250b93cd3e7550c685bec Coverage Product Protection Secure Endpoint Cloudlock N/A C |
Full article1,479 words · extracted from blog.talosintelligence.com · click to collapse
Friday, November 12, 2021 14:33
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 5 and Nov. 12. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.
For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. A visual depiction of the MITRE ATT&CK techniques associated with each threat is also shown. In these images, the brightness of the technique indicates how prevalent it is across all threat files where dynamic analysis was conducted. There are five distinct shades that are used, with the darkest indicating that no files exhibited technique behavior and the brightest indicating that technique behavior was observed from 75 percent or more of the files.
The most prevalent threats highlighted in this roundup are:
| Threat Name | Type | Description |
|---|---|---|
| Win.Dropper.Kuluoz-9906192-0 | Dropper | Kuluoz, sometimes known as "Asprox," is a modular remote access trojan that is also known to download and execute follow-on malware, such as fake antivirus software. Kuluoz is often delivered via spam emails pretending to be shipment delivery notifications or flight booking confirmations. |
| Win.Trojan.Tofsee-9906687-1 | Trojan | Tofsee is multi-purpose malware that features a number of modules used to carry out various activities such as sending spam messages, conducting click-fraud, mining cryptocurrency, and more. Infected systems become part of the Tofsee spam botnet and are used to send large volumes of spam messages to infect additional systems and increase the size of the botnet under the operator's control. |
| Win.Dropper.Fareit-9906313-1 | Dropper | The Fareit trojan is primarily an information stealer that can download and install other malware. |
| Win.Dropper.Nymaim-9906679-0 | Dropper | Nymaim is malware that can be used to deliver ransomware and other malicious payloads. It uses a domain-generation algorithm to generate potential command and control (C2) domains to connect to additional payloads. |
| Win.Dropper.TrickBot-9906689-0 | Dropper | Trickbot is a banking trojan targeting sensitive information for certain financial institutions. This malware is frequently distributed through malicious spam campaigns. Many of these campaigns rely on downloaders for distribution, such as VBScripts. |
Threat Breakdown
Win.Dropper.Kuluoz-9906192-0
Indicators of Compromise
- IOCs collected from dynamic analysis of 69 samples
| Registry Keys | Occurrences |
|---|---|
<HKCR>\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\159
| 69 |
<HKCU>\SOFTWARE\<random, matching '[a-zA-Z0-9]{5,9}'>
| 69 |
<HKCU>\SOFTWARE\XNDQWFAL
| 1 |
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
| 1 |
<HKCU>\SOFTWARE\UBKDDXHX
| 1 |
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
| 1 |
<HKCU>\SOFTWARE\SXLEVULR
| 1 |
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
| 1 |
<HKCU>\SOFTWARE\CPLFEVDG
| 1 |
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
| 1 |
<HKCU>\SOFTWARE\CPAGQABV
| 1 |
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
| 1 |
<HKCU>\SOFTWARE\BNTIPEWG
| 1 |
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
| 1 |
<HKCU>\SOFTWARE\QTTISAMA
| 1 |
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
| 1 |
<HKCU>\SOFTWARE\GNBKNCFN
| 1 |
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
| 1 |
<HKCU>\SOFTWARE\PQTDJSEE
| 1 |
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
| 1 |
<HKCU>\SOFTWARE\JRMMRSGV
| 1 |
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
| 1 |
<HKCU>\SOFTWARE\GWKSMKND
| 1 |
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
| 1 |
<HKCU>\SOFTWARE\FVCPXDNG
| 1 |
| Mutexes | Occurrences |
|---|---|
aaAdministrator
| 69 |
abAdministrator
| 69 |
| IP Addresses contacted by malware. Does not indicate maliciousness | Occurrences |
|---|---|
37[.]59[.]24[.]98
| 51 |
96[.]30[.]22[.]96
| 50 |
74[.]221[.]221[.]58
| 46 |
195[.]28[.]181[.]184
| 46 |
110[.]77[.]220[.]66
| 45 |
85[.]12[.]29[.]254
| 44 |
82[.]165[.]155[.]77
| 44 |
69[.]64[.]32[.]247
| 43 |
| Files and or directories created | Occurrences |
|---|---|
%LOCALAPPDATA%\<random, matching '[a-z]{8}'>.exe
| 69 |
%HOMEPATH%\Local Settings\Application Data\efcggqxj.exe
| 1 |
File Hashes
000bea950f66052cf937547d1f18bc47a1c6ff6d2d7d03bc09d60aa9c9b1c770
00e8fa17d90f77afadd8f255dca53b15d7f4c91719452d616b0cf663f9aeea99
033755fcc85dad80db7a94ea2dc178dc2cc823fe7b46084fd0ed20645b593290
037e90d5a83ea1360c1c74b34e3d648ba8645b32d9de456756e8ba6acac86d6d
04c74fa81fdd718c985fde6a502f1ed93a0d34255dc21b546fcc25425da9f31e
086985abecc0ee9c6b4caa28e74d3190994dbddae40524eb955526ad5be9f067
08de3a669a95eab65d9b95ecf7ed4085e162badd7b11b3ad126be4d9836d33e4
1ba2d5d15ede307fa5a969eb66654f4d485fc144e370531451c43dc6409737d9
1f18d7fcd14fa41d8256a373437ccfd3e0d0d4f80c41daeda99cfd493735acc8
1fb1390e6f86cc5eb108a6a38484fa91baf867622e7384d4777b7b12215cab8c
27862adbd6ba16a82915102b7cfbf36f25c7be6b7e0464a7bcd731c9c5c67316
36971d72adc866b317be68ddf5b3471825049a81231b53c5cfdacb292d49b4d6
39781b0d4b88226ae7cc4711c9d4724ee9010e9f543be7fbd3d31564d89546dd
3a36245e815538d2f84d05af6b1d71f81dd9c284cac1c0ceb2145d9f1bb9a7e9
3ca7c310670af06b7e57e5317283e03c2aa630b72f2d99f93734d960bf19040b
40023d8e643d0c49199f1d34beb4c79856f30cc155ff8f93300b9cca70affb0c
410c8127cf6d7bac2cb13d84dd8415aabc5831bdb617b49e8d28d024db906c51
42ca7b17fa816bf7dfdee073fd077f2327e31ae15f386c087912757894e2ac0a
44837ce7705a1c03338d220d186564930bcb1e739af90f04cd415b37b5719b90
48179cd3f777d239fb1f14ac8ed1472dd8c9dec65414b92953b5d67faad4f9b7
50fd2544836d5623d86f94307583fe7a4c88b11cdaa84f3f6b5a03a8631e8c0a
64d3d27a53d3cde1729f8897a09aac19557121ede477e4a1d18a86ef33b2d675
656ee6200af32f34de24c591ebb45d5652f30a435ce84abb6c8c04cd91e07500
696629d6b4f9965ec8cf1cc9cefe973f907731e8c6fadd1189413d63f4390b30
6a338dd0339ab184d2fa547e4a05b6cf94632dc3a03fb351ca703cea3f7f2262*See JSON for more IOCs
Coverage
| Product | Protection |
|---|---|
| Secure Endpoint | 
|
| Cloudlock | N/A |
| CWS |
|
| Email Security |
|
| Network Security | N/A |
| Stealthwatch | N/A |
| Stealthwatch Cloud | N/A |
| Secure Malware Analytics |
|
| Umbrella | N/A |
| WSA | N/A |
Screenshots of Detection
Secure Endpoint
Secure Malware Analytics
MITRE ATT&CK
Win.Trojan.Tofsee-9906687-1
Indicators of Compromise
- IOCs collected from dynamic analysis of 56 samples
| Registry Keys | Occurrences |
|---|---|
<HKU>\.DEFAULT\CONTROL PANEL\BUSES
| 56 |
<HKU>\.DEFAULT\CONTROL PANEL\BUSES
| 56 |
<HKCR>\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\159
| 56 |
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>
| 56 |
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>
| 56 |
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>
| 56 |
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>
| 56 |
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>
| 56 |
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>
| 56 |
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>
| 56 |
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>
| 56 |
<HKU>\.DEFAULT\CONTROL PANEL\BUSES
| 56 |
<HKU>\.DEFAULT\CONTROL PANEL\BUSES
| 56 |
<HKU>\.DEFAULT\CONTROL PANEL\BUSES
| 56 |
<HKU>\.DEFAULT\CONTROL PANEL\BUSES
| 56 |
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>
| 35 |
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS
| 4 |
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS
| 4 |
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS
| 4 |
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS
| 4 |
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS
| 3 |
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS
| 3 |
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS
| 3 |
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS
| 3 |
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS
| 3 |
| IP Addresses contacted by malware. Does not indicate maliciousness | Occurrences |
|---|---|
185[.]7[.]214[.]171
| 56 |
185[.]7[.]214[.]210
| 56 |
185[.]7[.]214[.]212
| 56 |
45[.]9[.]20[.]187
| 56 |
45[.]9[.]20[.]178/31
| 56 |
85[.]143[.]175[.]153
| 56 |
193[.]56[.]146[.]146
| 56 |
192[.]0[.]47[.]59
| 54 |
157[.]240[.]229[.]174
| 53 |
144[.]160[.]235[.]143
| 50 |
103[.]224[.]212[.]34
| 49 |
125[.]209[.]238[.]100
| 49 |
211[.]231[.]108[.]46
| 48 |
74[.]208[.]5[.]20
| 47 |
117[.]53[.]116[.]15
| 46 |
96[.]114[.]157[.]80
| 45 |
212[.]77[.]101[.]4
| 45 |
64[.]98[.]36[.]4
| 44 |
67[.]231[.]149[.]140
| 44 |
64[.]136[.]44[.]37
| 43 |
51[.]81[.]57[.]58
| 43 |
216[.]146[.]35[.]35
| 36 |
67[.]231[.]144[.]94
| 35 |
172[.]65[.]252[.]97
| 35 |
193[.]222[.]135[.]150
| 34 |
*See JSON for more IOCs
| Domain Names contacted by malware. Does not indicate maliciousness | Occurrences |
|---|---|
249[.]5[.]55[.]69[.]bl[.]spamcop[.]net
| 56 |
249[.]5[.]55[.]69[.]cbl[.]abuseat[.]org
| 56 |
249[.]5[.]55[.]69[.]dnsbl[.]sorbs[.]net
| 56 |
249[.]5[.]55[.]69[.]in-addr[.]arpa
| 56 |
249[.]5[.]55[.]69[.]sbl-xbl[.]spamhaus[.]org
| 56 |
249[.]5[.]55[.]69[.]zen[.]spamhaus[.]org
| 56 |
microsoft-com[.]mail[.]protection[.]outlook[.]com
| 56 |
microsoft[.]com
| 56 |
www[.]google[.]com
| 56 |
quadoil[.]ru
| 56 |
aspmx[.]l[.]google[.]com
| 55 |
whois[.]arin[.]net
| 54 |
whois[.]iana[.]org
| 54 |
www[.]instagram[.]com
| 53 |
mail[.]h-email[.]net
| 50 |
al-ip4-mx-vip1[.]prodigy[.]net
| 50 |
mx1[.]naver[.]com
| 49 |
park-mx[.]above[.]com
| 49 |
mx1[.]hanmail[.]net
| 49 |
mx-aol[.]mail[.]gm0[.]yahoodns[.]net
| 48 |
naver[.]com
| 48 |
hanmail[.]net
| 47 |
mx00[.]mail[.]com
| 47 |
www[.]youtube[.]com
| 46 |
nate[.]com
| 46 |
*See JSON for more IOCs
| Files and or directories created | Occurrences |
|---|---|
%SystemRoot%\SysWOW64\config\systemprofile
| 56 |
%SystemRoot%\SysWOW64\config\systemprofile:.repos
| 56 |
%SystemRoot%\SysWOW64\<random, matching '[a-z]{8}'>
| 56 |
%TEMP%\<random, matching '[a-z]{8}'>.exe
| 52 |
\Users\user\AppData\Local\Temp\wfowkckt.exe
| 2 |
%TEMP%\zsnzdsd.exe
| 1 |
%TEMP%\afpfty.exe
| 1 |
%TEMP%\atoaete.exe
| 1 |
%TEMP%\cvqcgvg.exe
| 1 |
\Users\user\AppData\Local\Temp\hdssxekb.exe
| 1 |
\Users\user\AppData\Local\Temp\gzkalibu.exe
| 1 |
\Users\user\AppData\Local\Temp\hzryxozg.exe
| 1 |
\Users\user\AppData\Local\Temp\cumtsjub.exe
| 1 |
\Users\user\AppData\Local\Temp\xtiinuar.exe
| 1 |
\Users\user\AppData\Local\Temp\fsbyzeqd.exe
| 1 |
\Users\user\AppData\Local\Temp\xhmzgbap.exe
| 1 |
\Users\user\AppData\Local\Temp\pqoybuzk.exe
| 1 |
\Users\user\AppData\Local\Temp\jwfcdiuh.exe
| 1 |
\Users\user\AppData\Local\Temp\lqaqej.exe
| 1 |
\Users\user\AppData\Local\Temp\msnqziid.exe
| 1 |
\Users\user\AppData\Local\Temp\uniuyny.exe
| 1 |
\Users\user\AppData\Local\Temp\xqbrczsl.exe
| 1 |
\Users\user\AppData\Local\Temp\vocogacp.exe
| 1 |
\Users\user\AppData\Local\Temp\uzjzns.exe
| 1 |
\Users\user\AppData\Local\Temp\yvgljtqn.exe
| 1 |
*See JSON for more IOCs
File Hashes
0116e2cc42cc67d4ee0fbd26b113a2883c9ef920dc84bb7ab622d1bf8851763f
02c7359dcb84754d1582eab7ef5f16938ee9cf88a83d150c1470a6b3b24bf31c
03fb15b85a5b40369f8e392427ea5f004447c90273b01ccbcbdff27d0fd5620b
0c4c84401bc57951c1add588817d96cae70469c0ad699b2c154855a730cf8afa
11bb33bf6c4dcf920e28a36b061353e87e314236faebe4563c3fa5c877230404
158001d30d5d3768e6fe0f1a1d7bf1ad0da65241a6f01196150b5cf8a52b9623
1d5f62d3687343709946d1bf46ed5e91b4659e376261a499722cf071d14a2e32
20db1c12886f165778eaabff78196c7166b43b18767d802373150408870b7d99
2a6ff1d92b275b5479f724cacbef20a3757227d7bf7f943c5a91609a370cf006
2aa24f0c26531e9222de7e2ce6f0453e0465a6545ac7accb5f9ffc1983fa4f9d
2ee90707f21676ebaf7e821bf02f24d56d1a7be273c8aa129eb60cacd09f19df
2fbb49dd038c61306b7c32663dcf6f6f5545b1538c90464c148980c69f4331b3
322f25513dc717ec609771e4988d5a962dd5b980bc4bf372d206ab991c092382
345af13820aaefd07456b97821b597c8c020c907541e25c32f304c4a1a3f324a
348d21e49e7bad86d434423c8052dd72bb27d9a9f43d6b2471a1063261c69c35
354f4a167b2bbdbdd1e8d36f26c4524f1454abb79e745c1a0a3945e9bb1ddeef
35b7bbf1581e93fad329c50307ae2f68964bf8866e437d308c56eda819acb8d7
40bfcd3518b19ded7d92a6930ab6e410002c333fe327044800599a95ee67e225
41f7a9f6f6ec0cd336288c833ba746c5d40dc7d49f3f5717e89d8dc74714d478
4de8148701b1fe0a054b13829fb3763a8645b6468463de3e38f33526307f9e8b
5d21753e0586d127c06cde17551bd702e449dfa8a4aca6ff1116251ff1fe7177
5e6fb10b614e5ea6832ca853f3c43c4943499ac63097fd57c980babf7e707cd4
5f5b0da28419c1a133e4949a129f2ae17db34fb3e64ce2c9dc84d91239c50082
5faa85eae77192413b213ae22e30a68a6e0b20e1c1d78a2663ed0c70a713be67
61cbe9585ff80a96da97ce3afcaccce268b72d089ba88abc417642aa3365dddf*See JSON for more IOCs
Coverage
| Product | Protection |
|---|---|
| Secure Endpoint |
|
| Cloudlock | N/A |
| CWS |
|
| Email Security |
|
| Network Security |
|
| Stealthwatch | N/A |
| Stealthwatch Cloud | N/A |
| Secure Malware Analytics |
|
| Umbrella |
|
| WSA |
|
Screenshots of Detection
Secure Endpoint
Secure Malware Analytics
MITRE ATT&CK
Win.Dropper.Fareit-9906313-1
Indicators of Compromise
- IOCs collected from dynamic analysis of 17 samples
| Registry Keys | Occurrences |
|---|---|
<HKCU>\SOFTWARE\WINRAR
| 17 |
<HKCR>\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\159
| 17 |
<HKCU>\SOFTWARE\WINRAR
| 17 |
<HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003E9
| 17 |
<HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000001F5
| 17 |
<HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003EC
| 17 |
| IP Addresses contacted by malware. Does not indicate maliciousness | Occurrences |
|---|---|
192[.]187[.]111[.]219
| 7 |
63[.]141[.]242[.]46
| 4 |
81[.]17[.]18[.]194
| 3 |
81[.]17[.]29[.]146
| 3 |
209[.]85[.]201[.]94
| 1 |
173[.]194[.]204[.]94
| 1 |
101[.]99[.]75[.]152
| 1 |
74[.]125[.]192[.]138
| 1 |
173[.]194[.]206[.]100
| 1 |
209[.]85[.]144[.]99
| 1 |
173[.]194[.]205[.]84
| 1 |
| Domain Names contacted by malware. Does not indicate maliciousness | Occurrences |
|---|---|
ru[.]agulino[.]com
| 17 |
wpad[.]example[.]org
| 2 |
computer[.]example[.]org
| 1 |
vmss-prod-weu[.]westeurope[.]cloudapp[.]azure[.]com
| 1 |
clientconfig[.]passport[.]net
| 1 |
| Files and or directories created | Occurrences |
|---|---|
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\filename.vbe
| 17 |
%APPDATA%\subfolder
| 17 |
%APPDATA%\subfolder\filename.bat
| 17 |
%TEMP%\-<random, matching '[0-9]{9}'>.bat
| 17 |
%HOMEPATH%\Start Menu\Programs\Startup\filename.vbe
| 1 |
%TEMP%\748562.bat
| 1 |
\Users\user\AppData\Local\CrashDumps\506825654.exe.2384.dmp
| 1 |
\Users\user\AppData\Local\Temp\WAXBDBC.tmp
| 1 |
\Users\user\AppData\Local\Temp\WERBF82.tmp.appcompat.txt
| 1 |
\Users\user\AppData\Local\Temp\WERBFB2.tmp.WERInternalMetadata.xml
| 1 |
\Users\user\AppData\Local\Temp\WERCABC.tmp.WERInternalMetadata.xml
| 1 |
\Users\user\AppData\Local\CrashDumps\506825708.exe.3876.dmp
| 1 |
\Users\user\AppData\Local\Temp\WAX3C1E.tmp
| 1 |
\Users\user\AppData\Local\Temp\WER3F0D.tmp.appcompat.txt
| 1 |
\Users\user\AppData\Local\Temp\WER3F6C.tmp.WERInternalMetadata.xml
| 1 |
File Hashes
03eee9c470a2987fe0a045530c2efd0bbbab9eeb5b91a893e682cf144e252107
18e5a593d4a89648b43f86383568469612c4f61d4b8361df299e1fdbe9ac42f5
34c862548b46506e25df6187be15486a2bc0de85b7e2b02b12745df7145faf5d
56d50fb071eb481a83ae011eb7a31fd6bee268fba1b0fe7aa880f6a108f9f682
5bdaafdaeb1ad0f8455de525022d95d40362d2766e78bd9eeecf7acf3426564e
666fdac0254a22535178f4cc056de7c43372359a1a9fc83c9b558770d278bc84
6be0f0991eebcdd021444994c3c812a89924b04b8ed27282e18b747305f27bf7
71ca1ab8c327e81b97f9b93684f6a2f8de7b194f4d20b65bad89660fdb04982c
94c9c78a6d2e0b1808bbbde2a69f32464c74c8ad0f902b0a7aea75d443db1866
9523e53935a018bbe2a297ba95578a7e988a0a402eed2a97cf46a41f797de971
9edb3091593479d03685b13b2eaa0104fb84bdc785c46cf70bb8e105e6589620
b46d16b74e5c430126372a5027108704074ebf5a87b1dc0634f41bc119b460dc
c94368d73c897f193f7dd20d749d2348fa80f818d19b27888c28bc8e41ccd262
d3873c324768de351219c9e50a33cecc3d15ab568064591ff9857fff86780c76
e0e0854a4bcd7bb49292b001954e76ea3aaa8639839073e35a72adf88e3a25cc
e1a572394b381e7ae7cca254ab171eb975f9e4e0be7480b01fb751be14712fe0
ea1c77d4d703fe6825dfa9e406b84375384719f21f3250b93cd3e7550c685becCoverage
| Product | Protection |
|---|---|
| Secure Endpoint |
|
| Cloudlock | N/A |
| CWS |
|
| Email Security |
|
| Network Security |
|
| Stealthwatch | N/A |
| Stealthwatch Cloud | N/A |
| Secure Malware Analytics |
|
| Umbrella |
|
| WSA |
|
Screenshots of Detection
Secure Endpoint
Secure Malware Analytics
MITRE ATT&CK
Win.Dropper.Nymaim-9906679-0
Indicators of Compromise
- IOCs collected from dynamic analysis of 23 samples
| Registry Keys | Occurrences |
|---|---|
<HKCU>\SOFTWARE\MICROSOFT\GOCFK
| 23 |
<HKCU>\SOFTWARE\MICROSOFT\GOCFK
| 23 |
<HKCR>\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\159
| 22 |
| Mutexes | Occurrences |
|---|---|
Local\{1181F583-B634-69BF-E703-D4756599024F}
| 23 |
Local\{180BBEAD-0447-044A-68BD-247EB6D0E352}
| 23 |
Local\{18DD7903-1E96-FEAF-92BF-014008A1248C}
| 23 |
Local\{92502033-C012-7F46-D6A8-0AC972DF6662}
| 23 |
Local\{25754F3F-7A37-56CA-31BB-3C9D33DA226B}
| 23 |
Local\{8B75523D-CAF4-D06B-A2AD-13EEF593AC52}
| 23 |
Local\{D2CC4CCA-CB77-CF10-8293-17C78DEC853F}
| 23 |
Local\{67EB9FBC-0AC5-BAD6-80A0-015E2C7D43E8}
| 23 |
Local\{F78DA135-BD1C-3BA1-2EC7-6B375301FFDF}
| 23 |
| Domain Names contacted by malware. Does not indicate maliciousness | Occurrences |
|---|---|
microsoft[.]com
| 23 |
google[.]com
| 23 |
hkzqekcz[.]net
| 23 |
zrailjorqed[.]pw
| 23 |
nckynkrjg[.]in
| 23 |
xxrwudfhbr[.]net
| 23 |
iuojcbwlb[.]in
| 23 |
gjlngkx[.]net
| 23 |
nmovreiit[.]in
| 23 |
gpuxnhtdhztg[.]in
| 23 |
xpbyti[.]pw
| 23 |
nlaoyufe[.]in
| 23 |
syffllqlu[.]pw
| 23 |
phgrcrm[.]net
| 23 |
qbpqbucz[.]in
| 23 |
hdrqny[.]pw
| 23 |
emcqaelhfn[.]pw
| 23 |
www[.]msftncsi[.]com
| 4 |
wpad[.]example[.]org
| 4 |
neolx[.]com
| 1 |
rqdptmnlyy[.]pw
| 1 |
arlllswc[.]com
| 1 |
gjyttpvb[.]net
| 1 |
ytfalkcclaw[.]in
| 1 |
afoctlamhq[.]in
| 1 |
*See JSON for more IOCs
| Files and or directories created | Occurrences |
|---|---|
%ProgramData%\ph
| 23 |
%ProgramData%\ph\fktiipx.ftf
| 23 |
%TEMP%\gocf.ksv
| 23 |
%ProgramData%\<random, matching '[a-z0-9]{3,7}'>
| 23 |
%APPDATA%\<random, matching '[a-z0-9]{3,7}'>
| 23 |
%LOCALAPPDATA%\<random, matching '[a-z0-9]{3,7}'>
| 23 |
%ProgramData%\jzk\icolry.ylg
| 5 |
\Users\user\AppData\Local\Temp\qnvgtx.eww
| 5 |
%TEMP%\aneba.qsz
| 1 |
\Documents and Settings\All Users\wrg\orjdwj.ppt
| 1 |
File Hashes
0a5a39e943850137bf7296a9b11e9af5c0e05e391c3381733cc2f03020208b12
1657415b3e51540e23ecb6fdc619978af4463ce9e9c880f5e4f0ef1558297040
1984124ab6ba6f3fdb04ff885408c9f4f35f22d8d07746ddd2a585cb412fde6a
2f9fd8377a8e7bfbe6b13198d578d06b883402a5084f6c1c5c4cdebabfbd8fce
305b0c43a3c29d6153f0636d77032debf4fceabc2c035d48268a09692ae6cd20
31181eee5991422042784e1f845d11a32e1381aea1d8009e7090d88393ba98bc
386f665bedb4efaef8d7c12d11e49d1fd488a5a2a543588762897fdc64caf858
3a95f93f80be8d0cd76705da445da77c1d498a8aba99ee222f8e451e81aa1454
3f438f5360c449ba9d1d9349c6a0fa2fcab962a89cdc16581ebc1fea79051768
51e01e124b5faa392ae3517603049fea41a5c13a6ec82aa3fc23c2db41961189
5395c7598ca1145728fe0ed9f2422bf8d7cdc5a4aefee9c66e9a4be014a39753
5d94592ee0b18888cec53c526984a7a2505c757b66d17986f3f237c3ac843c20
61753686a9b172316b339850fe425602122dadc8b9a880b6d8fe11a2061faf77
6300fa292145cb7ad0810ae32eb5742f3eb71fe36986eb15bc5bccf6a7c15b50
73f6323cdc4c439a7ee8626daf5a8219f5d2d91498acf3161abc8764e3150277
75df28107d722b325ca55f1639be556839b1ab5ae99256008edc8bcd469b30f8
84d6081d0a956de98053024cc863b23e15b842d6677a4ee22b00c5d63b10ee6b
a9c642d3899cf12cceff9fef3c83a36794b6ccb6539c8a778b0809ecc74ee6ce
b28275a44a8d9a4e8ac0740384d48df297fd59b12d6c0a22c74256bc6cbc4cb5
d91e71f0ccf719c2242aa8ffa03d675ce6c536c50b5da571f6ae87f1076c7c9b
dad54799bb4ffc4866978c7c655eae50bb1274b586dcf194f3fd64863d301e84
de1c74e3225d1170fa8494b327b2944b7e31968f4f5fedf17390ead6f3fd7691
f79946e8464c138f028b3d4ce15f04579b16600f49680a5e53a1c99ffae31007Coverage
| Product | Protection |
|---|---|
| Secure Endpoint |
|
| Cloudlock | N/A |
| CWS |
|
| Email Security |
|
| Network Security |
|
| Stealthwatch | N/A |
| Stealthwatch Cloud | N/A |
| Secure Malware Analytics |
|
| Umbrella |
|
| WSA |
|
Screenshots of Detection
Secure Endpoint
Secure Malware Analytics
MITRE ATT&CK
Win.Dropper.TrickBot-9906689-0
Indicators of Compromise
- IOCs collected from dynamic analysis of 26 samples
| Registry Keys | Occurrences |
|---|---|
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER
| 25 |
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND
| 25 |
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND
| 25 |
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION
| 25 |
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION
| 25 |
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER
| 25 |
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION
| 25 |
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION
| 25 |
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION
| 25 |
<HKCR>\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\159
| 25 |
| Mutexes | Occurrences |
|---|---|
Global\316D1C7871E10
| 25 |
| IP Addresses contacted by malware. Does not indicate maliciousness | Occurrences |
|---|---|
72[.]22[.]185[.]200
| 15 |
72[.]22[.]185[.]208
| 9 |
160[.]72[.]43[.]240
| 1 |
| Domain Names contacted by malware. Does not indicate maliciousness | Occurrences |
|---|---|
crl[.]microsoft[.]com
| 25 |
| Files and or directories created | Occurrences |
|---|---|
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2580483871-590521980-3826313501-500\a18ca4003deb042bbee7a40f15e1970b_d19ab989-a35f-4710-83df-7b2db7efe7c5
| 25 |
%ProgramData%\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_d19ab989-a35f-4710-83df-7b2db7efe7c5
| 25 |
%System32%\Tasks\Windows Network
| 25 |
%APPDATA%\wnetwork
| 25 |
%APPDATA%\wnetwork\Data
| 25 |
%APPDATA%\WNETWORK\<original file name>.exe
| 25 |
%System32%\Microsoft\Protect\S-1-5-18\User\496a850c-d71a-4ccc-b3de-e64e84a540af
| 18 |
%System32%\Microsoft\Protect\S-1-5-18\User\13022768-a353-4a4c-8032-ece2f429bad3
| 7 |
%TEMP%\<random, matching '[a-f0-9]{3,5}'>_appcompat.txt
| 7 |
%TEMP%\<random, matching '[A-F0-9]{4,5}'>.dmp
| 7 |
File Hashes
0205f7cb31c95adeab976245edd2808d58a066e39f8bc953a3e10347189f61ca
0295aa15b36df5df2c8beba2e056a50efe5a88bcc8d07adefaf262a54d27ac18
0ec324720fb6f0af3f230556949689f2fee2ecd529c8a513c7f12c096eae0758
157958a490ec7591a3318c783691ce26e8f525f5c88367341cbfa5aca577586e
1a3cd06480513c10bd6c487e9bb015111ec4e17bfe26312f769233ab7e22f7f7
2413d734d5844c4bda1641d3a06669c6918f22308f45fef63e0b3a3d32c815a6
342477e56614066942a58b31dfb00f2dbaddc041738bde17bb701eb7c2a6c012
442cf13192bc89185839b955a2a21f6a16a1ca028208cb332f930a33367e2814
4bb1d3c102a9319ee88afed519dea172735f763b55859085ca0a145ceeee6b82
54eec51d0cc063797c45dc68f4a0b4376246893b8c799cabaa62be3b288947b7
586126be0b9bf36790dfbd9dea8ceb927df1d4c94745c306e93062aec647b0b0
6086f48f02196b9db367b87819e0d4b8ecc381971c63fde3b8dbb871341a2e5a
7fc8d238f3ff3bd7d77e18111763ac554c2d289643dc077b2253f8ee1d575926
94b83154ffbc39c28cd5a461ad264bb5cea73822d7d1a4ca5471a6ff8b28569c
967366fbebcf26142423b0df333ea09ae01cc728d5ab54edbcd387030afcccde
a36b2cac421b101c599d704dd66407e652cc056e9d58abf52d46b5f8b23f20f1
a3bf700a4f33a7852820daa9d580c2e9f8a9e21e04670212d64a9a4884ae065c
a412aa575f67c189ea62191942acbe30db28548f2a900019c8a3368ce8d3ec81
ba1ff4f69508562ea2c62a39861c7281176b979e200d1ebb95e32338f936a490
bc775c4705a8724ff10e0a946b510017c5e762ea1877a22a1897db34a1e6fabe
c082233374ed32db6a234c6901cda079466eb9e0746a07c4625c1e68d2ffbccc
c4c1ced7f088f61260705540b870ffe4e33af54ef4a1e86f1ef5729ef349bb75
cd133a17f8aeaa36f510595c5fc11e22fb40fbb88150fab1971d1094e75e7611
d294e9b17cbda134bfe607cc2e214d2c689c582bc7a94f24588df028814bd928
d32532cc718758d511caf22a6238049d422c0e12b60a0146a845e760b34e2d1a*See JSON for more IOCs
Coverage
| Product | Protection |
|---|---|
| Secure Endpoint |
|
| Cloudlock | N/A |
| CWS |
|
| Email Security |
|
| Network Security | N/A |
| Stealthwatch | N/A |
| Stealthwatch Cloud | N/A |
| Secure Malware Analytics |
|
| Umbrella | N/A |
| WSA | N/A |
Screenshots of Detection
Secure Endpoint
Secure Malware Analytics
MITRE ATT&CK
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-1105-1112/