ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Cisco Talospublished ()ingested 1

Threat Round Up for Aug 25

mediumVulnerabilityimportance 30
Read the original
Tagsvulnerability

Indicators of compromiseAll →

TypeIndicatorContext
domainabvjlx.comh[.]com zisbon[.]com wyspqd[.]com oeuuvh[.]com udvjli[.]com abvjlx[.]com aoogeq[.]com ilo[.]brenz[.]pl lxoalw[.]com wvnyqa[.]com g
domainajiyoh.comIP Addresses 148[.]81[.]111[.]121 Domain Names klcwba[.]com ajiyoh[.]com dpwrjl[.]com uatcte[.]com imtxxh[.]com lobsyb[.]com xccky
domainaoogeq.comn[.]com wyspqd[.]com oeuuvh[.]com udvjli[.]com abvjlx[.]com aoogeq[.]com ilo[.]brenz[.]pl lxoalw[.]com wvnyqa[.]com gnapgq[.]com c
domainapi.ipify.org]127 Domain Names fv-st-konrad[.]de www[.]fv-st-konrad[.]de api[.]ipify[.]org api[.]nuget[.]org chocolatey[.]org dist[.]torproject[.]
domainapi.nuget.orgfv-st-konrad[.]de www[.]fv-st-konrad[.]de api[.]ipify[.]org api[.]nuget[.]org chocolatey[.]org dist[.]torproject[.]org Files and or d
domainaqqvuo.come[.]com bkegyi[.]com dgyolj[.]com ycztdl[.]com dtptuw[.]com aqqvuo[.]com ioafts[.]com caqiny[.]com zqkqzt[.]com dezims[.]com ukngd
domainbkegyi.coml[.]com ioiufb[.]com eyakmj[.]com ukjqcx[.]com twngee[.]com bkegyi[.]com dgyolj[.]com ycztdl[.]com dtptuw[.]com aqqvuo[.]com ioaft
domainchocolatey.orgwww[.]fv-st-konrad[.]de api[.]ipify[.]org api[.]nuget[.]org chocolatey[.]org dist[.]torproject[.]org Files and or directories created
domaincxniir.comcom ilo[.]brenz[.]pl lxoalw[.]com wvnyqa[.]com gnapgq[.]com cxniir[.]com gzoiji[.]com rrbuas[.]com tdsuye[.]com kfgsia[.]com vdbqh
domaindgyolj.comb[.]com eyakmj[.]com ukjqcx[.]com twngee[.]com bkegyi[.]com dgyolj[.]com ycztdl[.]com dtptuw[.]com aqqvuo[.]com ioafts[.]com caqin
domaindist.torproject.orgd[.]de api[.]ipify[.]org api[.]nuget[.]org chocolatey[.]org dist[.]torproject[.]org Files and or directories created %AppData%\Mozilla\Fire
domaindpwrjl.com148[.]81[.]111[.]121 Domain Names klcwba[.]com ajiyoh[.]com dpwrjl[.]com uatcte[.]com imtxxh[.]com lobsyb[.]com xcckyn[.]com uvebw
domaindtptuw.comx[.]com twngee[.]com bkegyi[.]com dgyolj[.]com ycztdl[.]com dtptuw[.]com aqqvuo[.]com ioafts[.]com caqiny[.]com zqkqzt[.]com dezim
domaineqyaud.come[.]com kfgsia[.]com vdbqhy[.]com ygmyqt[.]com upeuoz[.]com eqyaud[.]com wouaoc[.]com omkbel[.]com ioiufb[.]com eyakmj[.]com ukjqc
domainevaluator-expert.ro4[.]118 5[.]152[.]210[.]179 146[.]255[.]36[.]1 Domain Names evaluator-expert[.]ro Files and or directories created %SystemDrive%\Documents
domaineyakmj.comz[.]com eqyaud[.]com wouaoc[.]com omkbel[.]com ioiufb[.]com eyakmj[.]com ukjqcx[.]com twngee[.]com bkegyi[.]com dgyolj[.]com ycztd
domainflemingz.comses 138[.]128[.]191[.]146 Domain Names www[.]flemingz[.]com flemingz[.]com Files and or directories created %TEMP%\ReAIquyDcG.exe %T
domainfv-st-konrad.de[.]198 23[.]23[.]170[.]235 192[.]168[.]1[.]127 Domain Names fv-st-konrad[.]de www[.]fv-st-konrad[.]de api[.]ipify[.]org api[.]nuget[.]o
domaingnapgq.comcom aoogeq[.]com ilo[.]brenz[.]pl lxoalw[.]com wvnyqa[.]com gnapgq[.]com cxniir[.]com gzoiji[.]com rrbuas[.]com tdsuye[.]com kfgsi
domaingzoiji.comnz[.]pl lxoalw[.]com wvnyqa[.]com gnapgq[.]com cxniir[.]com gzoiji[.]com rrbuas[.]com tdsuye[.]com kfgsia[.]com vdbqhy[.]com ygmyq
domainiazfmh.come[.]com imtxxh[.]com lobsyb[.]com xcckyn[.]com uvebwz[.]com iazfmh[.]com zisbon[.]com wyspqd[.]com oeuuvh[.]com udvjli[.]com abvjl
domainicanhazip.com5[.]152[.]210[.]176 Domain Names keybeautysystemswest[.]com icanhazip[.]com Files and or directories created %AppData%\winapp\Nkahvx.
domainilo.brenz.pld[.]com oeuuvh[.]com udvjli[.]com abvjlx[.]com aoogeq[.]com ilo[.]brenz[.]pl lxoalw[.]com wvnyqa[.]com gnapgq[.]com cxniir[.]com gzo
domainimtxxh.comn Names klcwba[.]com ajiyoh[.]com dpwrjl[.]com uatcte[.]com imtxxh[.]com lobsyb[.]com xcckyn[.]com uvebwz[.]com iazfmh[.]com zisbo
domainioafts.comi[.]com dgyolj[.]com ycztdl[.]com dtptuw[.]com aqqvuo[.]com ioafts[.]com caqiny[.]com zqkqzt[.]com dezims[.]com ukngdn[.]com ousvf
domainioiufb.comt[.]com upeuoz[.]com eqyaud[.]com wouaoc[.]com omkbel[.]com ioiufb[.]com eyakmj[.]com ukjqcx[.]com twngee[.]com bkegyi[.]com dgyol
domainkeybeautysystemswest.com.]110 64[.]182[.]208[.]181 5[.]152[.]210[.]176 Domain Names keybeautysystemswest[.]com icanhazip[.]com Files and or directories created %AppData
domainkfgsia.comq[.]com cxniir[.]com gzoiji[.]com rrbuas[.]com tdsuye[.]com kfgsia[.]com vdbqhy[.]com ygmyqt[.]com upeuoz[.]com eqyaud[.]com wouao
domainklcwba.comts\RAS_MO_02 IP Addresses 148[.]81[.]111[.]121 Domain Names klcwba[.]com ajiyoh[.]com dpwrjl[.]com uatcte[.]com imtxxh[.]com lobsy
domainlobsyb.coma[.]com ajiyoh[.]com dpwrjl[.]com uatcte[.]com imtxxh[.]com lobsyb[.]com xcckyn[.]com uvebwz[.]com iazfmh[.]com zisbon[.]com wyspq
domainlxoalw.comcom udvjli[.]com abvjlx[.]com aoogeq[.]com ilo[.]brenz[.]pl lxoalw[.]com wvnyqa[.]com gnapgq[.]com cxniir[.]com gzoiji[.]com rrbua
domainoceanclubsreloaded.usesses 185[.]165[.]29[.]27 185[.]165[.]29[.]129 Domain Names oceanclubsreloaded[.]us oceanfreightclubs[.]ir Files and or directories created \
domainoceanfreightclubs.ir7 185[.]165[.]29[.]129 Domain Names oceanclubsreloaded[.]us oceanfreightclubs[.]ir Files and or directories created \TEMP\New Purchase Order
domainoeuuvh.comn[.]com uvebwz[.]com iazfmh[.]com zisbon[.]com wyspqd[.]com oeuuvh[.]com udvjli[.]com abvjlx[.]com aoogeq[.]com ilo[.]brenz[.]pl l
domainomkbel.comy[.]com ygmyqt[.]com upeuoz[.]com eqyaud[.]com wouaoc[.]com omkbel[.]com ioiufb[.]com eyakmj[.]com ukjqcx[.]com twngee[.]com bkegy
domainrrbuas.comw[.]com wvnyqa[.]com gnapgq[.]com cxniir[.]com gzoiji[.]com rrbuas[.]com tdsuye[.]com kfgsia[.]com vdbqhy[.]com ygmyqt[.]com upeuo
domaintdsuye.coma[.]com gnapgq[.]com cxniir[.]com gzoiji[.]com rrbuas[.]com tdsuye[.]com kfgsia[.]com vdbqhy[.]com ygmyqt[.]com upeuoz[.]com eqyau
domaintwngee.comc[.]com omkbel[.]com ioiufb[.]com eyakmj[.]com ukjqcx[.]com twngee[.]com bkegyi[.]com dgyolj[.]com ycztdl[.]com dtptuw[.]com aqqvu
domainuatcte.com1[.]121 Domain Names klcwba[.]com ajiyoh[.]com dpwrjl[.]com uatcte[.]com imtxxh[.]com lobsyb[.]com xcckyn[.]com uvebwz[.]com iazfm
domainudvjli.comz[.]com iazfmh[.]com zisbon[.]com wyspqd[.]com oeuuvh[.]com udvjli[.]com abvjlx[.]com aoogeq[.]com ilo[.]brenz[.]pl lxoalw[.]com w
domainukjqcx.comd[.]com wouaoc[.]com omkbel[.]com ioiufb[.]com eyakmj[.]com ukjqcx[.]com twngee[.]com bkegyi[.]com dgyolj[.]com ycztdl[.]com dtptu
domainupeuoz.coms[.]com tdsuye[.]com kfgsia[.]com vdbqhy[.]com ygmyqt[.]com upeuoz[.]com eqyaud[.]com wouaoc[.]com omkbel[.]com ioiufb[.]com eyakm
domainuvebwz.coml[.]com uatcte[.]com imtxxh[.]com lobsyb[.]com xcckyn[.]com uvebwz[.]com iazfmh[.]com zisbon[.]com wyspqd[.]com oeuuvh[.]com udvjl
domainvdbqhy.comr[.]com gzoiji[.]com rrbuas[.]com tdsuye[.]com kfgsia[.]com vdbqhy[.]com ygmyqt[.]com upeuoz[.]com eqyaud[.]com wouaoc[.]com omkbe
domainwouaoc.coma[.]com vdbqhy[.]com ygmyqt[.]com upeuoz[.]com eqyaud[.]com wouaoc[.]com omkbel[.]com ioiufb[.]com eyakmj[.]com ukjqcx[.]com twnge
domainwvnyqa.comcom abvjlx[.]com aoogeq[.]com ilo[.]brenz[.]pl lxoalw[.]com wvnyqa[.]com gnapgq[.]com cxniir[.]com gzoiji[.]com rrbuas[.]com tdsuy
domainwww.flemingz.comMutexes N/A IP Addresses 138[.]128[.]191[.]146 Domain Names www[.]flemingz[.]com flemingz[.]com Files and or directories created %TEMP%\
domainwww.fv-st-konrad.de70[.]235 192[.]168[.]1[.]127 Domain Names fv-st-konrad[.]de www[.]fv-st-konrad[.]de api[.]ipify[.]org api[.]nuget[.]org chocolatey[.]org di
domainwyspqd.comb[.]com xcckyn[.]com uvebwz[.]com iazfmh[.]com zisbon[.]com wyspqd[.]com oeuuvh[.]com udvjli[.]com abvjlx[.]com aoogeq[.]com ilo[.
domainxcckyn.comh[.]com dpwrjl[.]com uatcte[.]com imtxxh[.]com lobsyb[.]com xcckyn[.]com uvebwz[.]com iazfmh[.]com zisbon[.]com wyspqd[.]com oeuuv
domainycztdl.comj[.]com ukjqcx[.]com twngee[.]com bkegyi[.]com dgyolj[.]com ycztdl[.]com dtptuw[.]com aqqvuo[.]com ioafts[.]com caqiny[.]com zqkqz
domainygmyqt.comi[.]com rrbuas[.]com tdsuye[.]com kfgsia[.]com vdbqhy[.]com ygmyqt[.]com upeuoz[.]com eqyaud[.]com wouaoc[.]com omkbel[.]com ioiuf
domainzisbon.comh[.]com lobsyb[.]com xcckyn[.]com uvebwz[.]com iazfmh[.]com zisbon[.]com wyspqd[.]com oeuuvh[.]com udvjli[.]com abvjlx[.]com aooge
md5b413d53c92364baa9958fdda02cd8e9aREPORTS %TEMP%\ts\package\services\metadata\core-properties\b413d53c92364baa9958fdda02cd8e9a.psmdcp %TEMP%\ts\lib\net20\es\Microsoft.Win32.TaskScheduler
sha13488d8938caa8400f802c2439f4b8fcdce406396TWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES Value: 3488D8938CAA8400F802C2439F4B8FCDCE406396 <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICA
sha2560009657099e7e3f555a68ae39827099905339f5dafe648585175de089a75ba6bdd61e1f50b36e6fc6707054840c0912455bea073edc5806467ca8cb7046 0009657099e7e3f555a68ae39827099905339f5dafe648585175de089a75ba6b 3724ecf98a0a71f54c227e00417bf0ea603ca480ac6db2a2708cc275f62
sha256002eb4fddf6e8f9165e28694da6f368626282bd7e99c11f1eaeb365339c2331a%SystemDrive%\69w460.exe C:\Windows\friendl.dll File Hashes 002eb4fddf6e8f9165e28694da6f368626282bd7e99c11f1eaeb365339c2331a 01b538e451a390f7cfcdc263355dca070ea1a578d083fa94762912cff36
sha25601b538e451a390f7cfcdc263355dca070ea1a578d083fa94762912cff36b226b4fddf6e8f9165e28694da6f368626282bd7e99c11f1eaeb365339c2331a 01b538e451a390f7cfcdc263355dca070ea1a578d083fa94762912cff36b226b 026a7284b6420e06f20e683054e0ed01a0afa14321fe4094c14bdb63a46
sha256026a7284b6420e06f20e683054e0ed01a0afa14321fe4094c14bdb63a46ee17f8e451a390f7cfcdc263355dca070ea1a578d083fa94762912cff36b226b 026a7284b6420e06f20e683054e0ed01a0afa14321fe4094c14bdb63a46ee17f 04d8c0fd0f85b534c8a225be38e7bda9dc7edc248b1f6419fb64a99fde5
sha256029923c7508a27907e2c88baf9cc2effa2f78e81f4728eae2c185935f2a51fbdbde972b5d97e6bc163cd632fa7c2a1e9f1913abe69f8eb25d22a06063c8 029923c7508a27907e2c88baf9cc2effa2f78e81f4728eae2c185935f2a51fbd 07b63a132b60b293532787b50c7765c6af9cebcc0449592ad31dec1198f
sha25604d8c0fd0f85b534c8a225be38e7bda9dc7edc248b1f6419fb64a99fde5b4b11284b6420e06f20e683054e0ed01a0afa14321fe4094c14bdb63a46ee17f 04d8c0fd0f85b534c8a225be38e7bda9dc7edc248b1f6419fb64a99fde5b4b11 050e9daae7c0778e00b17a71d70f34a9ec60c7ac1d309d53ffd23e7a74f
sha256050e9daae7c0778e00b17a71d70f34a9ec60c7ac1d309d53ffd23e7a74f81b2e0fd0f85b534c8a225be38e7bda9dc7edc248b1f6419fb64a99fde5b4b11 050e9daae7c0778e00b17a71d70f34a9ec60c7ac1d309d53ffd23e7a74f81b2e 06ebf78a7f2f3cbc7a8961051f3bfe9211b8dc8fd255be6f9df7b96f261
sha25606ebf78a7f2f3cbc7a8961051f3bfe9211b8dc8fd255be6f9df7b96f261a46addaae7c0778e00b17a71d70f34a9ec60c7ac1d309d53ffd23e7a74f81b2e 06ebf78a7f2f3cbc7a8961051f3bfe9211b8dc8fd255be6f9df7b96f261a46ad 07509506034c49b52314ee53984af6556396da7070c9d0069324f555f72
sha25607509506034c49b52314ee53984af6556396da7070c9d0069324f555f722db6d78a7f2f3cbc7a8961051f3bfe9211b8dc8fd255be6f9df7b96f261a46ad 07509506034c49b52314ee53984af6556396da7070c9d0069324f555f722db6d 076e08eb3eae357b4ee75f9bc1e9fe8a9ea3b3e3ddafe244e0583e320a0
sha256076e08eb3eae357b4ee75f9bc1e9fe8a9ea3b3e3ddafe244e0583e320a0bfd26506034c49b52314ee53984af6556396da7070c9d0069324f555f722db6d 076e08eb3eae357b4ee75f9bc1e9fe8a9ea3b3e3ddafe244e0583e320a0bfd26 07ab8a56baed7f7014781b275e8324e8bb7974360ac05d017c65d40ed05
sha25607ab8a56baed7f7014781b275e8324e8bb7974360ac05d017c65d40ed05e18698eb3eae357b4ee75f9bc1e9fe8a9ea3b3e3ddafe244e0583e320a0bfd26 07ab8a56baed7f7014781b275e8324e8bb7974360ac05d017c65d40ed05e1869 07b5361cde1a670a587bd7d58160c97282415a025b4b9d1efa806a121e5
sha25607b5361cde1a670a587bd7d58160c97282415a025b4b9d1efa806a121e577027a56baed7f7014781b275e8324e8bb7974360ac05d017c65d40ed05e1869 07b5361cde1a670a587bd7d58160c97282415a025b4b9d1efa806a121e577027 Coverage Screenshots of Detection AMP ThreatGrid Win.Trojan
sha25607b63a132b60b293532787b50c7765c6af9cebcc0449592ad31dec1198fc8b5a3c7508a27907e2c88baf9cc2effa2f78e81f4728eae2c185935f2a51fbd 07b63a132b60b293532787b50c7765c6af9cebcc0449592ad31dec1198fc8b5a 12c9ae29a83bf6ecf5766d9f51a2927d586bed20c3d37e4e150ffecadf8
sha25612c9ae29a83bf6ecf5766d9f51a2927d586bed20c3d37e4e150ffecadf8cd010a132b60b293532787b50c7765c6af9cebcc0449592ad31dec1198fc8b5a 12c9ae29a83bf6ecf5766d9f51a2927d586bed20c3d37e4e150ffecadf8cd010 2d1cbae9da80482fffdbbcc4f761e5b12ffbfeb2446026862d381ac80fa
sha25614ab690a2f5d4fd74f280804a1b59f5c5442c1280e79ee861e68a421cac80ce3ppData%\winapp\Modules\injectDll64_configs\sinj File Hashes 14ab690a2f5d4fd74f280804a1b59f5c5442c1280e79ee861e68a421cac80ce3 2419210bdd20b352b357573e72eb82bafa801b078f25517546bd348e2e9
sha256220128b685d4e96e793756636e32257b8fd22e038890d8f194d1681343bea923f9e50a762ef29de5b56086d976f26446f0bcb5f2590c0354eae1318e0fb 220128b685d4e96e793756636e32257b8fd22e038890d8f194d1681343bea923 a4ad5629d490b466e4e62bf9048968ff45466c73849609b64d6617bf32e
sha2562419210bdd20b352b357573e72eb82bafa801b078f25517546bd348e2e93a50590a2f5d4fd74f280804a1b59f5c5442c1280e79ee861e68a421cac80ce3 2419210bdd20b352b357573e72eb82bafa801b078f25517546bd348e2e93a505 Coverage Screenshots of Detection AMP ThreatGrid Umbrella S
sha2562d1cbae9da80482fffdbbcc4f761e5b12ffbfeb2446026862d381ac80fa0f335e29a83bf6ecf5766d9f51a2927d586bed20c3d37e4e150ffecadf8cd010 2d1cbae9da80482fffdbbcc4f761e5b12ffbfeb2446026862d381ac80fa0f335 4c5c70e7c517e35f93fd65aa493a9bbad63561ad7dc8b5235e23ca843c9
sha2563724ecf98a0a71f54c227e00417bf0ea603ca480ac6db2a2708cc275f622710457099e7e3f555a68ae39827099905339f5dafe648585175de089a75ba6b 3724ecf98a0a71f54c227e00417bf0ea603ca480ac6db2a2708cc275f6227104 44cd48611f0044d98082ba3dd816b61fe80ee91812fc05ee1f3f37690f5
sha25644cd48611f0044d98082ba3dd816b61fe80ee91812fc05ee1f3f37690f51bacccf98a0a71f54c227e00417bf0ea603ca480ac6db2a2708cc275f6227104 44cd48611f0044d98082ba3dd816b61fe80ee91812fc05ee1f3f37690f51bacc 488f6347913c580600ca24527ab8a0f3d2129c597a6398cc857eec4f1b0
sha256488f6347913c580600ca24527ab8a0f3d2129c597a6398cc857eec4f1b0348c18611f0044d98082ba3dd816b61fe80ee91812fc05ee1f3f37690f51bacc 488f6347913c580600ca24527ab8a0f3d2129c597a6398cc857eec4f1b0348c1 4b9f88762b2eb226b86c5bb4ce04b4ffcd07d0e332bbc92ed6dd2d7d451
sha2564b9f88762b2eb226b86c5bb4ce04b4ffcd07d0e332bbc92ed6dd2d7d451c8269347913c580600ca24527ab8a0f3d2129c597a6398cc857eec4f1b0348c1 4b9f88762b2eb226b86c5bb4ce04b4ffcd07d0e332bbc92ed6dd2d7d451c8269 57c8d5b413e5ddc4bbf416ef8ac9b902eb1058e18b79e76ef5340c835c9
sha2564c5c70e7c517e35f93fd65aa493a9bbad63561ad7dc8b5235e23ca843c9c274eae9da80482fffdbbcc4f761e5b12ffbfeb2446026862d381ac80fa0f335 4c5c70e7c517e35f93fd65aa493a9bbad63561ad7dc8b5235e23ca843c9c274e 5d683f41aa10da94c4737aa8901fc92b93d4f5484f4728bcbd802b93362
sha25655a8224f9b571776935e0340c9093b35b90b9138ef87e8484429b27c9ea61681b6c6deace69313e1e164257ca0b5e5ce003c34c79ca1dc43dd67129f081 55a8224f9b571776935e0340c9093b35b90b9138ef87e8484429b27c9ea61681 9edbd6e5cf7cfa8f6c5ca9a80a487e420996cae0982fbcbfe72206c0b85
sha25656ef4bb6608968653af98649fddf204933134038b6b27b118ebedcdc5ec5af0eOffice\Recent\272622119.xls.LNK %TEMP%\wbfg.exe File Hashes 56ef4bb6608968653af98649fddf204933134038b6b27b118ebedcdc5ec5af0e 946def9e50a762ef29de5b56086d976f26446f0bcb5f2590c0354eae131
sha25657c8d5b413e5ddc4bbf416ef8ac9b902eb1058e18b79e76ef5340c835c9cfa738762b2eb226b86c5bb4ce04b4ffcd07d0e332bbc92ed6dd2d7d451c8269 57c8d5b413e5ddc4bbf416ef8ac9b902eb1058e18b79e76ef5340c835c9cfa73 6fe1e272df58349481d71357488f08fda7bf4709cd72be00ce5e42c2447
sha2565bf717cf8794bc159f95b59fb73e46d8e46fcca03d5dca9b47d0b398fb9db17a3f511b9ecaf14478330baa01d4384f168de4b9c25a42e2865fde11067e4 5bf717cf8794bc159f95b59fb73e46d8e46fcca03d5dca9b47d0b398fb9db17a a9832474a614d15382a50954c3adf5ab7774698dcf57417c80f2abc6403
sha2565d683f41aa10da94c4737aa8901fc92b93d4f5484f4728bcbd802b9336275d590e7c517e35f93fd65aa493a9bbad63561ad7dc8b5235e23ca843c9c274e 5d683f41aa10da94c4737aa8901fc92b93d4f5484f4728bcbd802b9336275d59 8b3c33104719d76829977a595901992bb7183ded8f5d1ef379281c7c158
sha2565e0fcf513867bb834af4ebb405a328d66838e528e32e420a89eab7b8619f18302de8afd8ac9d2a9df4c5f94ea0d44abdad70af70624f168c3c34036d35b 5e0fcf513867bb834af4ebb405a328d66838e528e32e420a89eab7b8619f1830 64091a671d00602e4f81f987207ac2b16f5c3e86f98add903bf369b528d
sha2565f312c0ec89ad31cb819663059c97505cc72032f429cff33c61995ca651d52c0921fa61c90a84ce29748ee334827fab456bb5807ad2f3e5c688bc539903 5f312c0ec89ad31cb819663059c97505cc72032f429cff33c61995ca651d52c0 afc27b6c6deace69313e1e164257ca0b5e5ce003c34c79ca1dc43dd6712
sha25664091a671d00602e4f81f987207ac2b16f5c3e86f98add903bf369b528db2d38f513867bb834af4ebb405a328d66838e528e32e420a89eab7b8619f1830 64091a671d00602e4f81f987207ac2b16f5c3e86f98add903bf369b528db2d38 9727223d176381c88f6f5f17a2e7f99981eaba31282a41c1ceb3158bccb
sha2566d20ac8668c1876117cfb7686d1dd71a82a88bc69595a9d698591a5ea41878b64e0dbe8bb08fa68c7aa73e44651a322d5a04e462e546d6cf0c9e4897235 6d20ac8668c1876117cfb7686d1dd71a82a88bc69595a9d698591a5ea41878b6 c8810c54be65f65747458e905afaaf534202d2c6bd5dc681309a1872042
sha2566fe1e272df58349481d71357488f08fda7bf4709cd72be00ce5e42c2447836495b413e5ddc4bbf416ef8ac9b902eb1058e18b79e76ef5340c835c9cfa73 6fe1e272df58349481d71357488f08fda7bf4709cd72be00ce5e42c244783649 6fef1c02e5d06c9cd2b29fee73e796791b7b84a1875ff19296140d49823
sha2566fef1c02e5d06c9cd2b29fee73e796791b7b84a1875ff19296140d49823621ae272df58349481d71357488f08fda7bf4709cd72be00ce5e42c244783649 6fef1c02e5d06c9cd2b29fee73e796791b7b84a1875ff19296140d49823621ae 6ff2121b359d8a2776c25293aa96b823759b0796e559e70bc6d2e8adaf2
sha2566ff2121b359d8a2776c25293aa96b823759b0796e559e70bc6d2e8adaf208fd7c02e5d06c9cd2b29fee73e796791b7b84a1875ff19296140d49823621ae 6ff2121b359d8a2776c25293aa96b823759b0796e559e70bc6d2e8adaf208fd7 8b0d3d287580a5095e92aaf357bb39e1ab754dd3eaa4ca9c2f7ee4727f5
sha25673c4f4e0dbe8bb08fa68c7aa73e44651a322d5a04e462e546d6cf0c9e4897235s\~$Normal.dotm %SystemDrive%\runme.docx (copy) File Hashes 73c4f4e0dbe8bb08fa68c7aa73e44651a322d5a04e462e546d6cf0c9e4897235 6d20ac8668c1876117cfb7686d1dd71a82a88bc69595a9d698591a5ea41
sha2568b0d3d287580a5095e92aaf357bb39e1ab754dd3eaa4ca9c2f7ee4727f5649dd21b359d8a2776c25293aa96b823759b0796e559e70bc6d2e8adaf208fd7 8b0d3d287580a5095e92aaf357bb39e1ab754dd3eaa4ca9c2f7ee4727f5649dd 8e03b31baaa847ffef1df04336d7629bd8c8ca169406768479114b91b96
sha2568b3c33104719d76829977a595901992bb7183ded8f5d1ef379281c7c158ef803f41aa10da94c4737aa8901fc92b93d4f5484f4728bcbd802b9336275d59 8b3c33104719d76829977a595901992bb7183ded8f5d1ef379281c7c158ef803 900df27eff06c022c5fc9f6ebdb6f5f1a1e9d65c2de1d5f6300c899937b
sha2568e03b31baaa847ffef1df04336d7629bd8c8ca169406768479114b91b96c9092d287580a5095e92aaf357bb39e1ab754dd3eaa4ca9c2f7ee4727f5649dd 8e03b31baaa847ffef1df04336d7629bd8c8ca169406768479114b91b96c9092 Coverage Screenshots of Detection AMP ThreatGrid Doc.Trojan
sha256900df27eff06c022c5fc9f6ebdb6f5f1a1e9d65c2de1d5f6300c899937bb95e73104719d76829977a595901992bb7183ded8f5d1ef379281c7c158ef803 900df27eff06c022c5fc9f6ebdb6f5f1a1e9d65c2de1d5f6300c899937bb95e7 9ef470811ceaab0d47bb4b8e0abdf7d783902c208fedda35f8292b60af7
sha256940723f511b9ecaf14478330baa01d4384f168de4b9c25a42e2865fde11067e4ed %TEMP%\ReAIquyDcG.exe %TEMP%\ReAIquyDcG.exeA File Hashes 940723f511b9ecaf14478330baa01d4384f168de4b9c25a42e2865fde11067e4 5bf717cf8794bc159f95b59fb73e46d8e46fcca03d5dca9b47d0b398fb9
sha256946def9e50a762ef29de5b56086d976f26446f0bcb5f2590c0354eae1318e0fbbb6608968653af98649fddf204933134038b6b27b118ebedcdc5ec5af0e 946def9e50a762ef29de5b56086d976f26446f0bcb5f2590c0354eae1318e0fb 220128b685d4e96e793756636e32257b8fd22e038890d8f194d1681343b
sha2569557c5337e1ebcc8dfe36e284be35c32ce22d2a4fbac56602d326598594899a8pp\group_tag %WinDir%\Tasks\services update.job File Hashes 9557c5337e1ebcc8dfe36e284be35c32ce22d2a4fbac56602d326598594899a8 b20fac264fb5724f17caafc34df08fc57879c0b30d360352a8e2b1ae3f9
sha2569727223d176381c88f6f5f17a2e7f99981eaba31282a41c1ceb3158bccbe08f4a671d00602e4f81f987207ac2b16f5c3e86f98add903bf369b528db2d38 9727223d176381c88f6f5f17a2e7f99981eaba31282a41c1ceb3158bccbe08f4 f095ae655db18fb27667ece1c168b97d42b1b164991cda154022d6f8e27
sha2569edbd6e5cf7cfa8f6c5ca9a80a487e420996cae0982fbcbfe72206c0b85845db24f9b571776935e0340c9093b35b90b9138ef87e8484429b27c9ea61681 9edbd6e5cf7cfa8f6c5ca9a80a487e420996cae0982fbcbfe72206c0b85845db e0d385356bc5dc0a7619553d391259b8acd0f226dafb719b505bec4cba5
sha2569ef470811ceaab0d47bb4b8e0abdf7d783902c208fedda35f8292b60af7f687027eff06c022c5fc9f6ebdb6f5f1a1e9d65c2de1d5f6300c899937bb95e7 9ef470811ceaab0d47bb4b8e0abdf7d783902c208fedda35f8292b60af7f6870 d3bc718d0cb24a9ffb25ae75d413f29fdb173e9174fd07d06ee8bb49ebe
sha256a0fc82de8afd8ac9d2a9df4c5f94ea0d44abdad70af70624f168c3c34036d35bnDir%\Prefetch\273142363.EXE-3748BAA7.pf \lsass File Hashes a0fc82de8afd8ac9d2a9df4c5f94ea0d44abdad70af70624f168c3c34036d35b 5e0fcf513867bb834af4ebb405a328d66838e528e32e420a89eab7b8619
sha256a4ad5629d490b466e4e62bf9048968ff45466c73849609b64d6617bf32e5cc5f8b685d4e96e793756636e32257b8fd22e038890d8f194d1681343bea923 a4ad5629d490b466e4e62bf9048968ff45466c73849609b64d6617bf32e5cc5f d6ece69e9f8035de573411d57ea11e0bb22d243e0d47b620b9cb9979321
sha256a9832474a614d15382a50954c3adf5ab7774698dcf57417c80f2abc6403996397cf8794bc159f95b59fb73e46d8e46fcca03d5dca9b47d0b398fb9db17a a9832474a614d15382a50954c3adf5ab7774698dcf57417c80f2abc640399639 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha256aecf2b9c77b76f08c6a240cd5b0782f3abba0a872caea783f5105b3b3f42851a69e9f8035de573411d57ea11e0bb22d243e0d47b620b9cb99793218b121 aecf2b9c77b76f08c6a240cd5b0782f3abba0a872caea783f5105b3b3f42851a Coverage Screenshots of Detection AMP ThreatGrid Umbrella D
sha256afc27b6c6deace69313e1e164257ca0b5e5ce003c34c79ca1dc43dd67129f081c0ec89ad31cb819663059c97505cc72032f429cff33c61995ca651d52c0 afc27b6c6deace69313e1e164257ca0b5e5ce003c34c79ca1dc43dd67129f081 55a8224f9b571776935e0340c9093b35b90b9138ef87e8484429b27c9ea
sha256b20fac264fb5724f17caafc34df08fc57879c0b30d360352a8e2b1ae3f9c20225337e1ebcc8dfe36e284be35c32ce22d2a4fbac56602d326598594899a8 b20fac264fb5724f17caafc34df08fc57879c0b30d360352a8e2b1ae3f9c2022 e77b85c8d93c7d1093eeea80621ad45ab3f091d537837a425b4e8829a20
sha256bce01bde972b5d97e6bc163cd632fa7c2a1e9f1913abe69f8eb25d22a06063c8ta%\Microsoft\Office\Recent\DHL Information.LNK File Hashes bce01bde972b5d97e6bc163cd632fa7c2a1e9f1913abe69f8eb25d22a06063c8 029923c7508a27907e2c88baf9cc2effa2f78e81f4728eae2c185935f2a
sha256c8810c54be65f65747458e905afaaf534202d2c6bd5dc681309a1872042946b3c8668c1876117cfb7686d1dd71a82a88bc69595a9d698591a5ea41878b6 c8810c54be65f65747458e905afaaf534202d2c6bd5dc681309a1872042946b3 f3b527e625e6f198b5d44150bd4b5408935e57b7f7b395deba33f1662e2
sha256c95ad921fa61c90a84ce29748ee334827fab456bb5807ad2f3e5c688bc5399037e625e6f198b5d44150bd4b5408935e57b7f7b395deba33f1662e2a2737 c95ad921fa61c90a84ce29748ee334827fab456bb5807ad2f3e5c688bc539903 5f312c0ec89ad31cb819663059c97505cc72032f429cff33c61995ca651
sha256d3bc718d0cb24a9ffb25ae75d413f29fdb173e9174fd07d06ee8bb49ebec23300811ceaab0d47bb4b8e0abdf7d783902c208fedda35f8292b60af7f6870 d3bc718d0cb24a9ffb25ae75d413f29fdb173e9174fd07d06ee8bb49ebec2330 e433044ade8b09c97cd4b2008bccb9f12d45e32f84a94efbc800754c58e
sha256d6ece69e9f8035de573411d57ea11e0bb22d243e0d47b620b9cb99793218b121629d490b466e4e62bf9048968ff45466c73849609b64d6617bf32e5cc5f d6ece69e9f8035de573411d57ea11e0bb22d243e0d47b620b9cb99793218b121 aecf2b9c77b76f08c6a240cd5b0782f3abba0a872caea783f5105b3b3f4
sha256e0d385356bc5dc0a7619553d391259b8acd0f226dafb719b505bec4cba58fb466e5cf7cfa8f6c5ca9a80a487e420996cae0982fbcbfe72206c0b85845db e0d385356bc5dc0a7619553d391259b8acd0f226dafb719b505bec4cba58fb46 Coverage Screenshots of Detection AMP ThreatGrid
sha256e433044ade8b09c97cd4b2008bccb9f12d45e32f84a94efbc800754c58ed3eb218d0cb24a9ffb25ae75d413f29fdb173e9174fd07d06ee8bb49ebec2330 e433044ade8b09c97cd4b2008bccb9f12d45e32f84a94efbc800754c58ed3eb2 efe8092be61ec8c11d6152fbf569517299f3a17322a14d5e1c13350ceae
sha256e77b85c8d93c7d1093eeea80621ad45ab3f091d537837a425b4e8829a2041aa4c264fb5724f17caafc34df08fc57879c0b30d360352a8e2b1ae3f9c2022 e77b85c8d93c7d1093eeea80621ad45ab3f091d537837a425b4e8829a2041aa4 fef300c8fad4477c75fd83aaa5a0033ee79c46e948148b4a7ed372943c3
sha256efe8092be61ec8c11d6152fbf569517299f3a17322a14d5e1c13350ceaeac22344ade8b09c97cd4b2008bccb9f12d45e32f84a94efbc800754c58ed3eb2 efe8092be61ec8c11d6152fbf569517299f3a17322a14d5e1c13350ceaeac223 ff428dd61e1f50b36e6fc6707054840c0912455bea073edc5806467ca8c
sha256f095ae655db18fb27667ece1c168b97d42b1b164991cda154022d6f8e270cd4923d176381c88f6f5f17a2e7f99981eaba31282a41c1ceb3158bccbe08f4 f095ae655db18fb27667ece1c168b97d42b1b164991cda154022d6f8e270cd49 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha256f3b527e625e6f198b5d44150bd4b5408935e57b7f7b395deba33f1662e2a2737c54be65f65747458e905afaaf534202d2c6bd5dc681309a1872042946b3 f3b527e625e6f198b5d44150bd4b5408935e57b7f7b395deba33f1662e2a2737 c95ad921fa61c90a84ce29748ee334827fab456bb5807ad2f3e5c688bc5
sha256fef300c8fad4477c75fd83aaa5a0033ee79c46e948148b4a7ed372943c306f5d5c8d93c7d1093eeea80621ad45ab3f091d537837a425b4e8829a2041aa4 fef300c8fad4477c75fd83aaa5a0033ee79c46e948148b4a7ed372943c306f5d Coverage Screenshots of Detection AMP Umbrella Umbrella Scr
sha256ff428dd61e1f50b36e6fc6707054840c0912455bea073edc5806467ca8cb704692be61ec8c11d6152fbf569517299f3a17322a14d5e1c13350ceaeac223 ff428dd61e1f50b36e6fc6707054840c0912455bea073edc5806467ca8cb7046 0009657099e7e3f555a68ae39827099905339f5dafe648585175de089a7
Full article1,031 words · extracted from blog.talosintelligence.com · click to collapse

Friday, September 1, 2017 13:12

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between August 25 and September 1. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

  • Doc.Downloader.TrickBot-6336123-0
    Downloader
    Campaigns continue to distribute new TrickBot samples through malspam & document based downloaders. This recent variant of downloader mimics account correspondence from a large financial institution, but the macro used for fetching a TrickBot sample has been stripped down to a simple deobfuscation & shell invocation.
  • Doc.Dropper.Agent-6336106-0
    Office Macro Downloader
    This is an obfuscated Office Macro downloader that attempts to download a malicious payload executable.
  • Doc.Macro.Obfuscation-6336014-0
    Office Macro
    This cluster of Office Macro documents use the same obfuscation technique to prevent quick analysis. Manual analysis of the obfuscation technique shows many variables and instructions that are not used or evaulated to junk code.
  • Doc.Trojan.Agent-6336128-0
    Office Macro based downloader
    This set of downloaders uses string obfuscation in VBA to build a download command for the shell and execute it with the VBA Shell function. It was recently observed delivering TrickBot among other paylods.
  • Vbs.Trojan.VBSTrojan-6336102-0
    Trojan
    This Visual Basic script downloader fetches a binary from the internet and install it into the system.
  • Win.Malware.Dinwod-6336124-0
    Dropper
    Dinwod is a polymorphic dropper. It copies modified versions of itself to the root directory then deletes the original file. The copies drop the payload DLL in the Windows directory, then force legitimate processes to run the payload via DLL injection.
  • Win.Trojan.AlmanCloud-6336008
    Trojan
    This is a Trojan. It contains many anti-debugging and anti-vm tricks to hinder the dynamic analysis and detect instrumented envrionments. The binary can try also to register itself as a Windows service and it modifies the host file. Moreover, it has functionalities to infect USB drives plugged to the victim's computer and it may work also as keylogger. Finally, it has code to contact remote servers and upload the collected information.
  • Win.Trojan.Cuegoe-6336130-0
    Trojan
    This is a trojan downloader. The payload varies and is unpacked inside a lengthy linear decryption routine.

Threats

Doc.Downloader.TrickBot-6336123-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • Global\PowerShell_CommandAnalysis_Lock_S-1-5-21-2580483871-590521980-3826313501-500
  • Outlook_Perf_Library_Lock_PID_90c IP Addresses
  • 210[.]16[.]102[.]251
  • 216[.]239[.]32[.]21
  • 93[.]114[.]64[.]118
  • 5[.]152[.]210[.]179
  • 146[.]255[.]36[.]1 Domain Names
  • evaluator-expert[.]ro Files and or directories created
  • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\bicprcv.exe
  • %AppData%\winapp\Modules\systeminfo64
  • \srvsvc
  • %TEMP%\cdqfm.bat
  • %AppData%\winapp\group_tag
  • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\cdqfm.bat
  • %TEMP%\bicprcv.exe
  • %AppData%\winapp\Modules\injectDll64_configs\dpost
  • %AppData%\winapp\Modules\injectDll64_configs\dinj
  • %AppData%\winapp\aganpat.exe
  • %AppData%\winapp\Modules\injectDll64
  • %AppData%\winapp\client_id
  • %AppData%\winapp\ahboqbu.exe
  • %AppData%\winapp\Modules\injectDll64_configs\sinj File Hashes
  • 14ab690a2f5d4fd74f280804a1b59f5c5442c1280e79ee861e68a421cac80ce3
  • 2419210bdd20b352b357573e72eb82bafa801b078f25517546bd348e2e93a505

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella


Screenshot

Doc.Dropper.Agent-6336106-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • 185[.]165[.]29[.]27
  • 185[.]165[.]29[.]129 Domain Names
  • oceanclubsreloaded[.]us
  • oceanfreightclubs[.]ir Files and or directories created
  • \TEMP\New Purchase Order.xls
  • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40DVD2HR\OT[1].exe
  • %AppData%\Microsoft\Office\Recent\New Purchase Order.LNK
  • %AppData%\Microsoft\Office\Recent\272622119.xls.LNK
  • %TEMP%\wbfg.exe File Hashes
  • 56ef4bb6608968653af98649fddf204933134038b6b27b118ebedcdc5ec5af0e
  • 946def9e50a762ef29de5b56086d976f26446f0bcb5f2590c0354eae1318e0fb
  • 220128b685d4e96e793756636e32257b8fd22e038890d8f194d1681343bea923
  • a4ad5629d490b466e4e62bf9048968ff45466c73849609b64d6617bf32e5cc5f
  • d6ece69e9f8035de573411d57ea11e0bb22d243e0d47b620b9cb99793218b121
  • aecf2b9c77b76f08c6a240cd5b0782f3abba0a872caea783f5105b3b3f42851a

Coverage

Screenshots of DetectionAMP


ThreatGrid


Umbrella

Doc.Macro.Obfuscation-6336014-0

Indicators of Compromise
Registry Keys

  • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
  • Value: PnpInstanceID
  • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES
  • Value: 3488D8938CAA8400F802C2439F4B8FCDCE406396
  • <HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3488D8938CAA8400F802C2439F4B8FCDCE406396 Mutexes
  • socket.1
  • socket.0
  • tty_list::mutex.0
  • socket.2
  • Global\刐ƶ IP Addresses
  • 82[.]195[.]75[.]101
  • 91[.]219[.]237[.]229
  • 109[.]163[.]234[.]8
  • 38[.]229[.]72[.]16
  • 23[.]21[.]138[.]252
  • 31[.]185[.]104[.]20
  • 78[.]47[.]38[.]226
  • 104[.]20[.]73[.]28
  • 184[.]73[.]220[.]206
  • 46[.]28[.]110[.]244
  • 81[.]7[.]16[.]182
  • 198[.]199[.]64[.]217
  • 174[.]129[.]241[.]106
  • 50[.]19[.]238[.]1
  • 154[.]35[.]132[.]70
  • 62[.]210[.]92[.]11
  • 72[.]21[.]81[.]200
  • 151[.]80[.]42[.]103
  • 5[.]39[.]92[.]199
  • 86[.]59[.]21[.]38
  • 192[.]30[.]255[.]120
  • 192[.]30[.]255[.]121
  • 185[.]100[.]86[.]128
  • 144[.]76[.]163[.]93
  • 178[.]62[.]22[.]36
  • 104[.]20[.]74[.]28
  • 51[.]254[.]101[.]242
  • 46[.]252[.]26[.]2
  • 89[.]45[.]235[.]21
  • 192[.]168[.]1[.]1
  • 178[.]62[.]86[.]96
  • 178[.]62[.]197[.]82
  • 52[.]173[.]193[.]166
  • 192[.]168[.]1[.]255
  • 120[.]29[.]217[.]46
  • 138[.]201[.]14[.]197
  • 86[.]59[.]119[.]88
  • 192[.]30[.]255[.]113
  • 192[.]30[.]255[.]112
  • 85[.]25[.]116[.]81
  • 107[.]22[.]255[.]198
  • 23[.]23[.]170[.]235
  • 192[.]168[.]1[.]127 Domain Names
  • fv-st-konrad[.]de
  • www[.]fv-st-konrad[.]de
  • api[.]ipify[.]org
  • api[.]nuget[.]org
  • chocolatey[.]org
  • dist[.]torproject[.]org  Files and or directories created
  • %AppData%\Mozilla\Firefox\Profiles\1lcuq8ab.default\cert8.db
  • %TEMP%\ts\lib\net40\fr\Microsoft.Win32.TaskScheduler.resources.dll
  • %TEMP%\ts\lib\net452\it\Microsoft.Win32.TaskScheduler.resources.dll
  • %AppData%\MS\s\SECURITY
  • %AppData%\MS\s\EXAMPLES
  • %AppData%\MS\s\socat.exe
  • %TEMP%\ts\lib\net40\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
  • %System32%\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.blf
  • %AppData%\MS\Tor\tor.exe
  • %AppData%\tor\cached-microdescs.new
  • %AppData%\tor\lock
  • %TEMP%\ts\lib\net20\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
  • %TEMP%\ts\_rels\.rels
  • %AppData%\MS\Tor\libgcc_s_sjlj-1.dll
  • \TEMP\~$L Information.doc
  • %TEMP%\ts\lib\net35\es\Microsoft.Win32.TaskScheduler.resources.dll
  • %System32%\Tasks\MRT
  • %System32%\Tasks\SC
  • %TEMP%\ts\lib\net40\JetBrains.Annotations.xml
  • %AppData%\MS\Tor\libevent_core-2-0-5.dll
  • %TEMP%\ts\lib\net40\JetBrains.Annotations.dll
  • %AppData%\MS\s\cygreadline7.dll
  • %TEMP%\ts\lib\net20\JetBrains.Annotations.xml
  • %AppData%\MS\Data\Tor\geoip6
  • %AppData%\Mozilla\Firefox\Profiles\1lcuq8ab.default\prefs.js
  • %TEMP%\ts\lib\net20\Microsoft.Win32.TaskScheduler.XML
  • %TEMP%\ts\lib\net35\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
  • %TEMP%\ts\lib\net20\JetBrains.Annotations.dll
  • %WinDir%\AppCompat\Programs\RecentFileCache.bcf
  • %AppData%\MS\Tor\zlib1.dll
  • \Users\Administrator\Documents\20170822\PowerShell_transcript.PC.SLCVvGfn.20170822125043.txt
  • %AppData%\tor\cached-microdesc-consensus
  • %TEMP%\ts\lib\net40\Microsoft.Win32.TaskScheduler.XML
  • %TEMP%\ts\lib\net35\it\Microsoft.Win32.TaskScheduler.resources.dll
  • %TEMP%\ts\lib\net20\Microsoft.Win32.TaskScheduler.dll
  • %AppData%\MS\Tor\libevent-2-0-5.dll
  • %AppData%\MS\Tor\tor-gencert.exe
  • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{16FC3937-61E8-4A38-8962-5CC96E748100}.tmp
  • %AppData%\MS\s\cygssl-1.0.0.dll
  • %TEMP%\ts\lib\net40\es\Microsoft.Win32.TaskScheduler.resources.dll
  • \Users\Administrator\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_mshta.exe_b620274e31657385a0786969c6cab647bc5a5eb0_48824423\Report.wer
  • %TEMP%\ts\lib\net40\it\Microsoft.Win32.TaskScheduler.resources.dll
  • %AppData%\MS\s\cygwrap-0.dll
  • %TEMP%\ts\lib\net452\Microsoft.Win32.TaskScheduler.dll
  • %AppData%\MS\s\cygncursesw-10.dll
  • %AppData%\MS\s\VERSION
  • %AppData%\MS\Data\Tor\geoip
  • %AppData%\MS\s\README
  • %TEMP%\ts\lib\net35\JetBrains.Annotations.dll
  • %TEMP%\ts\lib\net452\es\Microsoft.Win32.TaskScheduler.resources.dll
  • %TEMP%\ts\lib\net35\JetBrains.Annotations.xml
  • %TEMP%\ts\[Content_Types].xml
  • \Users\Administrator\Documents\20170822\PowerShell_transcript.PC.tnwsG1BN.20170822125100.txt
  • %TEMP%\ts\lib\net40\Microsoft.Win32.TaskScheduler.dll
  • %AppData%\MS\s\cygcrypto-1.0.0.dll
  • %AppData%\MS\Tor\libssp-0.dll
  • %TEMP%\ts\lib\net35\fr\Microsoft.Win32.TaskScheduler.resources.dll
  • \TEMP\DHL Information.doc
  • %TEMP%\ts\lib\net20\it\Microsoft.Win32.TaskScheduler.resources.dll
  • %AppData%\MS\Tor\libevent_extra-2-0-5.dll
  • %TEMP%\ts\lib\net452\Microsoft.Win32.TaskScheduler.XML
  • %AppData%\tor\cached-certs
  • \Users\Administrator\Documents\20170822\PowerShell_transcript.PC.PBM+k85t.20170822125056.txt
  • %TEMP%\ts\lib\net35\de\Microsoft.Win32.TaskScheduler.resources.dll
  • %System32%\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.0.regtrans-ms
  • %AppData%\MS\s\BUGREPORTS
  • %TEMP%\ts\package\services\metadata\core-properties\b413d53c92364baa9958fdda02cd8e9a.psmdcp
  • %TEMP%\ts\lib\net20\es\Microsoft.Win32.TaskScheduler.resources.dll
  • %AppData%\MS\Tor\libeay32.dll
  • %TEMP%\ts\lib\net20\de\Microsoft.Win32.TaskScheduler.resources.dll
  • %AppData%\MS\Tor\ssleay32.dll
  • %TEMP%\ts\lib\net452\JetBrains.Annotations.dll
  • %TEMP%\ts\lib\net40\de\Microsoft.Win32.TaskScheduler.resources.dll
  • \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40DVD2HR\api_ipify_org[1].txt
  • %TEMP%\ts\lib\net35\Microsoft.Win32.TaskScheduler.dll
  • %TEMP%\ts\lib\net452\JetBrains.Annotations.xml
  • %AppData%\MS\s\FAQ
  • %TEMP%\ts\lib\net20\fr\Microsoft.Win32.TaskScheduler.resources.dll
  • \Users\Administrator\Documents\20170822\PowerShell_transcript.PC.MiXmZ0jf.20170822125034.txt
  • %System32%\Tasks\SUT
  • %AppData%\tor\state
  • %TEMP%\ts\lib\net452\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll
  • %TEMP%\7238.exe
  • %TEMP%\CVRD4FC.tmp.cvr
  • %AppData%\MS\s\CHANGES
  • %TEMP%\ts\TaskScheduler.nuspec
  • %TEMP%\ts\lib\net35\Microsoft.Win32.TaskScheduler.XML
  • %AppData%\MS\s\README.md
  • %AppData%\Microsoft\Office\Recent\DHL Information.LNK File Hashes
  • bce01bde972b5d97e6bc163cd632fa7c2a1e9f1913abe69f8eb25d22a06063c8
  • 029923c7508a27907e2c88baf9cc2effa2f78e81f4728eae2c185935f2a51fbd
  • 07b63a132b60b293532787b50c7765c6af9cebcc0449592ad31dec1198fc8b5a
  • 12c9ae29a83bf6ecf5766d9f51a2927d586bed20c3d37e4e150ffecadf8cd010
  • 2d1cbae9da80482fffdbbcc4f761e5b12ffbfeb2446026862d381ac80fa0f335
  • 4c5c70e7c517e35f93fd65aa493a9bbad63561ad7dc8b5235e23ca843c9c274e
  • 5d683f41aa10da94c4737aa8901fc92b93d4f5484f4728bcbd802b9336275d59
  • 8b3c33104719d76829977a595901992bb7183ded8f5d1ef379281c7c158ef803
  • 900df27eff06c022c5fc9f6ebdb6f5f1a1e9d65c2de1d5f6300c899937bb95e7
  • 9ef470811ceaab0d47bb4b8e0abdf7d783902c208fedda35f8292b60af7f6870
  • d3bc718d0cb24a9ffb25ae75d413f29fdb173e9174fd07d06ee8bb49ebec2330
  • e433044ade8b09c97cd4b2008bccb9f12d45e32f84a94efbc800754c58ed3eb2
  • efe8092be61ec8c11d6152fbf569517299f3a17322a14d5e1c13350ceaeac223
  • ff428dd61e1f50b36e6fc6707054840c0912455bea073edc5806467ca8cb7046
  • 0009657099e7e3f555a68ae39827099905339f5dafe648585175de089a75ba6b
  • 3724ecf98a0a71f54c227e00417bf0ea603ca480ac6db2a2708cc275f6227104
  • 44cd48611f0044d98082ba3dd816b61fe80ee91812fc05ee1f3f37690f51bacc
  • 488f6347913c580600ca24527ab8a0f3d2129c597a6398cc857eec4f1b0348c1
  • 4b9f88762b2eb226b86c5bb4ce04b4ffcd07d0e332bbc92ed6dd2d7d451c8269
  • 57c8d5b413e5ddc4bbf416ef8ac9b902eb1058e18b79e76ef5340c835c9cfa73
  • 6fe1e272df58349481d71357488f08fda7bf4709cd72be00ce5e42c244783649
  • 6fef1c02e5d06c9cd2b29fee73e796791b7b84a1875ff19296140d49823621ae
  • 6ff2121b359d8a2776c25293aa96b823759b0796e559e70bc6d2e8adaf208fd7
  • 8b0d3d287580a5095e92aaf357bb39e1ab754dd3eaa4ca9c2f7ee4727f5649dd
  • 8e03b31baaa847ffef1df04336d7629bd8c8ca169406768479114b91b96c9092

Coverage

Screenshots of Detection AMP


ThreatGrid

Doc.Trojan.Agent-6336128-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • 216[.]138[.]226[.]110
  • 64[.]182[.]208[.]181
  • 5[.]152[.]210[.]176 Domain Names
  • keybeautysystemswest[.]com
  • icanhazip[.]com Files and or directories created
  • %AppData%\winapp\Nkahvx.exe
  • %AppData%\winapp\client_id
  • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\Olaiwy.exe
  • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\lubuj.bat
  • %AppData%\winapp\group_tag
  • %WinDir%\Tasks\services update.job File Hashes
  • 9557c5337e1ebcc8dfe36e284be35c32ce22d2a4fbac56602d326598594899a8
  • b20fac264fb5724f17caafc34df08fc57879c0b30d360352a8e2b1ae3f9c2022
  • e77b85c8d93c7d1093eeea80621ad45ab3f091d537837a425b4e8829a2041aa4
  • fef300c8fad4477c75fd83aaa5a0033ee79c46e948148b4a7ed372943c306f5d  

Coverage

Screenshots of Detection AMP


Umbrella


Umbrella


Screenshot

Vbs.Trojan.VBSTrojan-6336102-0

Indicators of Compromise
Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
  • Value: AutoDetect
  • <HKCU>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness Mutexes
  • N/A IP Addresses
  • 138[.]128[.]191[.]146 Domain Names
  • www[.]flemingz[.]com
  • flemingz[.]comFiles and or directories created
  • %TEMP%\ReAIquyDcG.exe
  • %TEMP%\ReAIquyDcG.exeA File Hashes
  • 940723f511b9ecaf14478330baa01d4384f168de4b9c25a42e2865fde11067e4
  • 5bf717cf8794bc159f95b59fb73e46d8e46fcca03d5dca9b47d0b398fb9db17a
  • a9832474a614d15382a50954c3adf5ab7774698dcf57417c80f2abc640399639

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Malware.Dinwod-6336124-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • N/A Files and or directories created
  • %SystemDrive%\jr8g6w6.exe
  • %SystemDrive%\3t9bd.exe
  • %SystemDrive%\dvdvv.exe
  • %SystemDrive%\69w460.exe
  • C:\Windows\friendl.dll File Hashes
  • 002eb4fddf6e8f9165e28694da6f368626282bd7e99c11f1eaeb365339c2331a
  • 01b538e451a390f7cfcdc263355dca070ea1a578d083fa94762912cff36b226b
  • 026a7284b6420e06f20e683054e0ed01a0afa14321fe4094c14bdb63a46ee17f
  • 04d8c0fd0f85b534c8a225be38e7bda9dc7edc248b1f6419fb64a99fde5b4b11
  • 050e9daae7c0778e00b17a71d70f34a9ec60c7ac1d309d53ffd23e7a74f81b2e
  • 06ebf78a7f2f3cbc7a8961051f3bfe9211b8dc8fd255be6f9df7b96f261a46ad
  • 07509506034c49b52314ee53984af6556396da7070c9d0069324f555f722db6d
  • 076e08eb3eae357b4ee75f9bc1e9fe8a9ea3b3e3ddafe244e0583e320a0bfd26
  • 07ab8a56baed7f7014781b275e8324e8bb7974360ac05d017c65d40ed05e1869
  • 07b5361cde1a670a587bd7d58160c97282415a025b4b9d1efa806a121e577027

Coverage

Screenshots of Detection AMP


ThreatGrid

Win.Trojan.AlmanCloud-6336008

Indicators of Compromise
Registry Keys

  • <HKU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  • <HKU>\SessionInformation
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
  • Value: Collection
  • <HKU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • <HKLM>\SYSTEM\ControlSet001\Services\Eventlog\Application
  • <HKU>\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
  • <HKU>\SessionInformation
  • <HKLM>\SYSTEM\ControlSet001\Enum\Root\LEGACY_RASMAN\0000\Control
  • <HKLM>\SYSTEM\ControlSet001\Services\Eventlog\Application\Microsoft H.323 Telephony Service Provider
  • <HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
  • <HKLM>\SYSTEM\ControlSet001\Enum\Root\LEGACY_TAPISRV\0000\Control Mutexes
  • \BaseNamedObjects\Global\RAS_MO_01
  • Local\MSCTF.Asm.MutexDefault1
  • \BaseNamedObjects\RAS_MO_02 IP Addresses
  • 148[.]81[.]111[.]121 Domain Names
  • klcwba[.]com
  • ajiyoh[.]com
  • dpwrjl[.]com
  • uatcte[.]com
  • imtxxh[.]com
  • lobsyb[.]com
  • xcckyn[.]com
  • uvebwz[.]com
  • iazfmh[.]com
  • zisbon[.]com
  • wyspqd[.]com
  • oeuuvh[.]com
  • udvjli[.]com
  • abvjlx[.]com
  • aoogeq[.]com
  • ilo[.]brenz[.]pl
  • lxoalw[.]com
  • wvnyqa[.]com
  • gnapgq[.]com
  • cxniir[.]com
  • gzoiji[.]com
  • rrbuas[.]com
  • tdsuye[.]com
  • kfgsia[.]com
  • vdbqhy[.]com
  • ygmyqt[.]com
  • upeuoz[.]com
  • eqyaud[.]com
  • wouaoc[.]com
  • omkbel[.]com
  • ioiufb[.]com
  • eyakmj[.]com
  • ukjqcx[.]com
  • twngee[.]com
  • bkegyi[.]com
  • dgyolj[.]com
  • ycztdl[.]com
  • dtptuw[.]com
  • aqqvuo[.]com
  • ioafts[.]com
  • caqiny[.]com
  • zqkqzt[.]com
  • dezims[.]com
  • ukngdn[.]com
  • ousvfo[.]com
  • bdgxqr[.]com
  • axqeuo[.]com
  • bidnxy[.]com
  • heuaot[.]com
  • gqugaq[.]com
  • aikuul[.]com
  • eiijba[.]com
  • qsjite[.]com
  • btaeqx[.]com
  • teioez[.]com
  • obwijg[.]com Files and or directories created
  • %System32%\wbem\Logs\wbemess.log
  • \Users\Administrator\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF
  • \Users\Administrator\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{684B4A19-F6D3-453D-B879-0BEB15FECE08}.FSD
  • %System32%\drivers\etc\hosts
  • \Users\Administrator\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF
  • \ntsvcs
  • %WinDir%\Prefetch\273142363.EXE-3748BAA7.pf
  • \lsass File Hashes
  • a0fc82de8afd8ac9d2a9df4c5f94ea0d44abdad70af70624f168c3c34036d35b
  • 5e0fcf513867bb834af4ebb405a328d66838e528e32e420a89eab7b8619f1830
  • 64091a671d00602e4f81f987207ac2b16f5c3e86f98add903bf369b528db2d38
  • 9727223d176381c88f6f5f17a2e7f99981eaba31282a41c1ceb3158bccbe08f4
  • f095ae655db18fb27667ece1c168b97d42b1b164991cda154022d6f8e270cd49

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Trojan.Cuegoe-6336130-0

Indicators of Compromise
Registry Keys

  • HKU\Software\Microsoft\Office\12.0\Word
  • HKU\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • N/A Files and or directories created
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\D.tmp
  • %SystemDrive%\~$runme.docx
  • %SystemDrive%\runme.exe
  • %AppData%\Microsoft\Templates\~$Normal.dotm
  • %SystemDrive%\runme.docx (copy) File Hashes
  • 73c4f4e0dbe8bb08fa68c7aa73e44651a322d5a04e462e546d6cf0c9e4897235
  • 6d20ac8668c1876117cfb7686d1dd71a82a88bc69595a9d698591a5ea41878b6
  • c8810c54be65f65747458e905afaaf534202d2c6bd5dc681309a1872042946b3
  • f3b527e625e6f198b5d44150bd4b5408935e57b7f7b395deba33f1662e2a2737
  • c95ad921fa61c90a84ce29748ee334827fab456bb5807ad2f3e5c688bc539903
  • 5f312c0ec89ad31cb819663059c97505cc72032f429cff33c61995ca651d52c0
  • afc27b6c6deace69313e1e164257ca0b5e5ce003c34c79ca1dc43dd67129f081
  • 55a8224f9b571776935e0340c9093b35b90b9138ef87e8484429b27c9ea61681
  • 9edbd6e5cf7cfa8f6c5ca9a80a487e420996cae0982fbcbfe72206c0b85845db
  • e0d385356bc5dc0a7619553d391259b8acd0f226dafb719b505bec4cba58fb46

Coverage

Screenshots of Detection AMP


ThreatGrid

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-round-up-0825-0901/