MALICIOUS Threat Names: Gen:Variant.Barys.127331 Trojan.PWS.ZKD
Total Page:16
File Type:pdf, Size:1020Kb
DYNAMIC ANALYSIS REPORT #5911857 Classifications: Spyware Lokibot C2/Generic-A Gen:Variant.Nemesis.1464 MALICIOUS Threat Names: Gen:Variant.Barys.127331 Trojan.PWS.ZKD Verdict Reason: - Sample Type Windows Exe (x86-32) Sample Name deZBpGP3HfhxPOIf.exe ID #2187282 MD5 7d92a55119f09bb46b48b64bf541e75b SHA1 f6f6945cc13edbb7b9213317f91e57497a9f3397 SHA256 38fa948bf971903a64d251a0afeada8065449eaaed939ec666c0f9566502d598 File Size 164.31 KB Report Created 2021-04-28 09:30 (UTC+2) Target Environment win10_64_th2_en_mso2016 | exe X-Ray Vision for Malware - www.vmray.com 1 / 23 DYNAMIC ANALYSIS REPORT #5911857 OVERVIEW VMRay Threat Identifiers (23 rules, 64 matches) Score Category Operation Count Classification 5/5 YARA Malicious content matched by YARA rules 2 Spyware • Rule "Lokibot" from ruleset "Malware" has matched on a memory dump for (process #1) dezbpgp3hfhxpoif.exe. • Rule "Lokibot" from ruleset "Malware" has matched on the function strings for (process #2) dezbpgp3hfhxpoif.exe. 5/5 Data Collection Tries to read cached credentials of various applications 1 Spyware • Tries to read sensitive data of: QtWeb Internet Browser, Total Commander, FTP Navigator, Trojita, Pidgin, Microsoft Outlook, Pocomail, Opera Mail, FAR Manager, IncrediMail, FileZilla, KiTTY, Bitvise SSH Client, BlazeFTP, NCH Fling, NCH Classic FTP, Internet Explorer, PuTTY, WinChips, LinasFTP, Internet Explorer / Edge, SecureFX. 4/5 Reputation Contacts known malicious URL 1 - • Reputation analysis labels the URL "http://203.159.80.239/tele/jhgfghj/fre.php" which was contacted by (process #2) dezbpgp3hfhxpoif.exe as "C2/Generic-A". 4/5 Antivirus Malicious content was detected by heuristic scan 4 - • Built-in AV detected the sample itself as "Gen:Variant.Nemesis.1464". • Built-in AV detected the dropped file C:\Users\RDHJ0C~1\AppData\Local\Temp\nsb9E0D.tmp\wn296y7dbe3hv.dll as "Gen:Variant.Barys.127331". • Built-in AV detected a memory dump of (process #1) dezbpgp3hfhxpoif.exe as "Trojan.PWS.ZKD". • Built-in AV detected a memory dump of (process #1) dezbpgp3hfhxpoif.exe as "Gen:Variant.Barys.127331". 3/5 Discovery Reads installed applications 1 Spyware • Reads installed programs by enumerating the SOFTWARE registry key. 2/5 Data Collection Reads sensitive browser data 4 - • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of web browser "QtWeb Internet Browser" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read credentials of web browser "Internet Explorer" by reading from the system's credential vault. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of web browser "Internet Explorer / Edge" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of web browser "Internet Explorer / Edge" by file. 2/5 Data Collection Reads sensitive application data 5 - • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of application "Pidgin" by file. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of application "Bitvise SSH Client" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of application "KiTTY" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of application "PuTTY" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of application "WinChips" by registry. 2/5 Data Collection Reads sensitive ftp data 10 - • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of ftp application "LinasFTP" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of ftp application "FileZilla" by file. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of ftp application "BlazeFTP" by file. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of ftp application "BlazeFTP" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of ftp application "Total Commander" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of ftp application "FAR Manager" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of ftp application "SecureFX" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of ftp application "NCH Fling" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of ftp application "NCH Classic FTP" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of ftp application "FTP Navigator" by file. 2/5 Data Collection Reads sensitive mail data 5 - X-Ray Vision for Malware - www.vmray.com 2 / 23 DYNAMIC ANALYSIS REPORT #5911857 • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of mail application "Pocomail" by file. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of mail application "IncrediMail" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of mail application "Opera Mail" by file. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of mail application "Microsoft Outlook" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to read sensitive data of mail application "Trojita" by registry. 2/5 Anti Analysis Delays execution 1 - • (Process #2) dezbpgp3hfhxpoif.exe has a thread which sleeps more than 5 minutes. 2/5 Anti Analysis Makes direct system call to possibly evade hooking based sandboxes 5 - • (Process #1) dezbpgp3hfhxpoif.exe makes a direct system call to "NtUnmapViewOfSection". • (Process #1) dezbpgp3hfhxpoif.exe makes a direct system call to "NtCreateSection". • (Process #1) dezbpgp3hfhxpoif.exe makes a direct system call to "NtMapViewOfSection". • (Process #1) dezbpgp3hfhxpoif.exe makes a direct system call to "NtWriteVirtualMemory". • (Process #1) dezbpgp3hfhxpoif.exe makes a direct system call to "NtResumeThread". 2/5 Injection Writes into the memory of a process running from a created or modified executable 1 - • (Process #1) dezbpgp3hfhxpoif.exe modifies memory of (process #2) dezbpgp3hfhxpoif.exe. 2/5 Injection Modifies control flow of a process running from a created or modified executable 1 - • (Process #1) dezbpgp3hfhxpoif.exe alters context of (process #2) dezbpgp3hfhxpoif.exe. 1/5 Hide Tracks Creates process with hidden window 1 - • (Process #1) dezbpgp3hfhxpoif.exe starts (process #2) dezbpgp3hfhxpoif.exe with a hidden window. 1/5 Obfuscation Reads from memory of another process 1 - • (Process #1) dezbpgp3hfhxpoif.exe reads from (process #2) dezbpgp3hfhxpoif.exe. 1/5 Discovery Reads system data 1 - • (Process #2) dezbpgp3hfhxpoif.exe reads the cryptographic machine GUID from registry. 1/5 Mutex Creates mutex 1 - • (Process #2) dezbpgp3hfhxpoif.exe creates mutex with name "B7274519EDDE9BDC8AE51348". 1/5 Discovery Possibly does reconnaissance 13 - • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "Comodo IceDragon" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "Safari" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "K-Meleon" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "Mozilla SeaMonkey" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "Mozilla Flock" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "Cyberfox" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "Total Commander" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "NetScape" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "Default Programs" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "Bitvise SSH Client" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "SecureFX" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "Postbox" by registry. • (Process #2) dezbpgp3hfhxpoif.exe tries to gather information about application "Trojita" by registry. 1/5 Privilege Escalation Enables process privilege 1 - X-Ray Vision for Malware - www.vmray.com 3 / 23 DYNAMIC ANALYSIS REPORT #5911857 • (Process #2) dezbpgp3hfhxpoif.exe enables process privilege "SeDebugPrivilege". 1/5 Execution Executes itself 1 - • (Process #1) dezbpgp3hfhxpoif.exe executes a copy of the sample at c:\users\rdhj0cnfevzx\desktop\dezbpgp3hfhxpoif.exe. 1/5 Execution Drops PE file 1 - • (Process #1) dezbpgp3hfhxpoif.exe drops file "C:\Users\RDHJ0C~1\AppData\Local\Temp\nsb9E0D.tmp\wn296y7dbe3hv.dll". 1/5 Network Connection Performs DNS request 2 - • (Process #2) dezbpgp3hfhxpoif.exe resolves host name "203.159.80.239" to IP "203.159.80.239". 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 • (Process #2) dezbpgp3hfhxpoif.exe resolves host name " 97 8B 8B 8F åððíïìñîêæñçïñíìæðð8Bð9Añ93 9A 95" 97to98 IP99 98 "-".97 95 99 8D 9A 8F 97 8F 1/5 Network Connection Connects to remote host 1 - • (Process #2) dezbpgp3hfhxpoif.exe opens an outgoing TCP connection to host "203.159.80.239:80". - Trusted Known clean file 2 - • File "C:\Users\RDhJ0CNFevzX\AppData\Roaming\9EDDE9\9BDC8A.lck" is a known clean file. • File "c: \users\rdhj0cnfevzx\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1560258661-3990802383-1811730007-1000\3d3578a85286f88c6cd9d151e4412949_03845cb8-7441-4a2f- 8c0f-c90408af5778" is a known clean file. Remarks Anti-Sleep Triggered (0x0200000E): The overall