Thursday, November 9, 2023 13:11
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 3 and Nov. 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org , or ClamAV.net .
For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. A visual depiction of the MITRE ATT&CK techniques associated with each threat is also shown. In these images, the brightness of the technique indicates how prevalent it is across all threat files where dynamic analysis was conducted. There are five distinct shades that are used, with the darkest indicating that no files exhibited technique behavior and the brightest indicating that technique behavior was observed from 75 percent or more of the files.
The most prevalent threats highlighted in this roundup are:
Threat Name Type Description Win.Dropper.njRAT-10013547-0 Dropper njRAT, also known as Bladabindi, is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014. Win.Dropper.Zeus-10013588-0 Dropper Ponystealer is known to steal credentials from more than 100 different applications and may also install other malware such as a remote access tool (RAT). Win.Dropper.Tofsee-10013531-0 Dropper Tofsee is multi-purpose malware that features a number of modules used to carry out various activities such as sending spam messages, conducting click fraud, mining cryptocurrency, and more. Infected systems become part of the Tofsee spam botnet and are used to send large volumes of spam messages to infect additional systems and increase the size of the botnet under the operator's control. Win.Dropper.Glupteba-10013467-0 Dropper Glupteba is a multi-purpose trojan that uses the infected machine to mine cryptocurrency and steal sensitive information like usernames and passwords, spreads over the network using exploits like EternalBlue, and leverages a rootkit component to remain hidden. Glupteba has also been observed using the Bitcoin blockchain to store configuration information. Win.Downloader.Upatre-10013406-0 Downloader Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware. Win.Malware.Diztakun-10013372-0 Malware Diztakun is a trojan dropped by another malware family or downloaded by a user that will modify system settings. This malware is known for its use of Image File Execution Options (IFEO) to gain persistence and inject itself into other executables. Doc.Malware.Valyria-10013349-0 Malware These variants of Valyria are malicious Microsoft Word documents that contain embedded VBA macros used to distribute other malware.
Threat Breakdown Win.Dropper.njRAT-10013547-0 Indicators of Compromise IOCs collected from dynamic analysis of 12 samples Registry Keys Occurrences \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: EnableLUA 12 \S-1-5-21-2580483871-590521980-3826313501-500 Value Name: di 12 \ENVIRONMENT Value Name: SEE_MASK_NOZONECHECKS 12 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: ConsentPromptBehaviorAdmin 12 \SOFTWARE\7657C14284185FBD3FB108B43C7467BA 12 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 7657c14284185fbd3fb108b43c7467ba 12 \SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 7657c14284185fbd3fb108b43c7467ba 12 \SOFTWARE\7657C14284185FBD3FB108B43C7467BA Value Name: [kl] 12 \LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL Value Name: NodeSlots 1 \LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL Value Name: MRUListEx 1 \LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\\1 Value Name: MRUListEx 1 \LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\\1\0 Value Name: MRUListEx 1
Mutexes Occurrences 7657c14284185fbd3fb108b43c7467ba12
Files and or directories created Occurrences %TEMP%\server.exe12 %TEMP%\12 %TEMP%\2922\2922.exe1 %TEMP%\6781\6781.exe1 %TEMP%\4928\4928.exe1 %TEMP%\2924\2924.exe1 %TEMP%\6119\6119.exe1 %TEMP%\2989\2989.exe1 %TEMP%\2369\2369.exe1 %TEMP%\2894\2894.exe1 %TEMP%\4627\4627.exe1 %TEMP%\960\960.exe1 %TEMP%\7015\7015.exe1 %TEMP%\6329\6329.exe1
File Hashes 00ac33ba819475ab380691c51b37ef3f0aae4789dea3ee19a941dc2875350a91
Coverage
Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security N/A Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella N/A WSA N/A
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Dropper.Zeus-10013588-0 Indicators of Compromise IOCs collected from dynamic analysis of 30 samples Registry Keys Occurrences \SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} Value Name: FaviconPath 7 \SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} Value Name: Deleted 7 \SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES Value Name: DefaultScope 7 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} 7 \Software\Microsoft\ 7 \SOFTWARE\MICROSOFT\INTERNET EXPLORER\PRIVACY Value Name: CleanCookies 4 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.101 Value Name: CheckSetting 4 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.103 Value Name: CheckSetting 4 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.100 Value Name: CheckSetting 4 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.102 Value Name: CheckSetting 4 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.104 Value Name: CheckSetting 4 \SOFTWARE\DC3_FEXEC 3 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Taskmgr 2 \SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: UserInit 2 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: {1A01E4EA-2D84-D670-B0DB-AEA399D273CB} 2 \SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: LANDrivers 1 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: help 1 \SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: help 1 \SOFTWARE\MICROSOFT\KEWUZA Value Name: Kuombao 1 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: {8E249526-629F-428A-AE89-37BA344B74E9} 1 \SOFTWARE\MICROSOFT\PAHUIH Value Name: Ozzunaso 1 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: {ACEB48EA-5F14-3060-00C6-58E8C8BD1132} 1 \SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: Shell 1 \SOFTWARE\MICROSOFT\DACOU Value Name: Raohfyiqu 1 \SOFTWARE\MICROSOFT\MAQU Value Name: Izalfe 1
Mutexes Occurrences UACMutexxxxx16 Local\{} 7 GLOBAL\{} 6 UFR33 DC_MUTEX-TKAU2Y62 Global\19e8f421-7c3b-11ee-9660-001517aeb5c31 Global\1d29d6e1-7c3b-11ee-9660-0015174de9441 Global\1ba38501-7c3b-11ee-9660-001517b129f41 DC_MUTEX-V8SHNMZ1 Global\31c933c1-7c8b-11ee-9660-0015171a3bbd1
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 192[.]229[.]211[.]1087 13[.]107[.]21[.]2005 142[.]250[.]64[.]651 31[.]170[.]164[.]1701
Domain Names contacted by malware. Does not indicate maliciousness Occurrences www[.]bing[.]com7 cacerts[.]digicert[.]com7 c0p1[.]com2 salarsokoot[.]no-ip[.]biz2 www[.]unitedstateforus[.]com2 tf2m[.]ru1 pin47[.]blogspot[.]ru1 ftp[.]ytruhgnhvjukuffkk[.]p[.]ht1 gbproof[.]org1 spitfire[.]ufcfan[.]org1 maldovaars[.]com1
Files and or directories created Occurrences %APPDATA%\10 %TEMP%\tmp.bat 7 %APPDATA%\.exe 7 %SystemRoot%\SysWOW64\Drivers\task.exe2 %APPDATA%\InstallDir1 %APPDATA%\InstallDir\help.exe1 %System32%\windi32.exe1 %ProgramData%\systemskey.ini1 %APPDATA%\Utus\uvuw.oxi1 %TEMP%\cd8e8b5b178c2d9e5acbdeda4854746eb2709cba2fbb2e986ae1dc25f6c0d575.exe1 %TEMP%\YaCheck.exe1 %APPDATA%\Weyf\eqsyl.vot1 %APPDATA%\Ivlov\qinee.asy1 %TEMP%\5d673897a553689e7b4ca6d3be149211f1027f9c82891af1ce65ea1c9639119b.exe1 %TEMP%\report_05-11-2023_18-26-11-11B0A35710D760E40567A55CF3411F9E-NLGD.bin1 %TEMP%\NO_PWDS_report_05-11-2023_18-26-11-11B0A35710D760E40567A55CF3411F9E-NLGD.bin1 %APPDATA%\Hyraix\viaqf.alh1 %APPDATA%\Onuvy\talyk.cea1 %APPDATA%\Ypep\huni.ryo1 %APPDATA%\Ziyblo\usoxh.ili1 %SystemRoot%\serwos.exe1
File Hashes 097f1d24084ad3668f6f92daa4fc05da8540623492c158ea41ee7ec86399bd21
Coverage
Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella N/A WSA N/A
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Dropper.Tofsee-10013531-0 Indicators of Compromise IOCs collected from dynamic analysis of 17 samples Registry Keys Occurrences \SYSTEM\CONTROLSET001\SERVICES\ 14 \SYSTEM\CONTROLSET001\SERVICES\ Value Name: Type 14 \SYSTEM\CONTROLSET001\SERVICES\ Value Name: Start 14 \SYSTEM\CONTROLSET001\SERVICES\ Value Name: ErrorControl 14 \SYSTEM\CONTROLSET001\SERVICES\ Value Name: DisplayName 14 \SYSTEM\CONTROLSET001\SERVICES\ Value Name: WOW64 14 \SYSTEM\CONTROLSET001\SERVICES\ Value Name: ObjectName 14 \.DEFAULT\CONTROL PANEL\BUSES 13 \.DEFAULT\CONTROL PANEL\BUSES Value Name: Config2 13 \SYSTEM\CONTROLSET001\SERVICES\ Value Name: Description 13 \.DEFAULT\CONTROL PANEL\BUSES Value Name: Config0 13 \.DEFAULT\CONTROL PANEL\BUSES Value Name: Config1 13 \SYSTEM\CONTROLSET001\SERVICES\ Value Name: ImagePath 13 \SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\blniewvr 2 \SOFTWARE\MICROSOFT\ASSISTANCE\CLIENT\1.0\SETTINGS Value Name: IsConnected 1 \SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\isupldcy 1 \SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\oyavrjie 1 \SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\vfhcyqpl 1 \SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\mwytphgc 1 \SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\eoqlhzyu 1 \SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\gqsnjbaw 1 \SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\zjlgcutp 1 \SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\dnpkgyxt 1 \SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\lvxsogfb 1 \SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\akmhdvuq 1
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 176[.]113[.]115[.]13614 80[.]66[.]75[.]414 176[.]113[.]115[.]13514 45[.]143[.]201[.]23814 176[.]113[.]115[.]8414 62[.]122[.]184[.]9214 80[.]66[.]75[.]7714 83[.]97[.]73[.]4414 31[.]13[.]65[.]17413 31[.]13[.]65[.]5213 172[.]217[.]165[.]13210 93[.]115[.]25[.]4910 34[.]120[.]241[.]21410 93[.]115[.]25[.]109 93[.]115[.]25[.]739 93[.]115[.]25[.]138 93[.]115[.]25[.]1108 158[.]160[.]73[.]478 149[.]154[.]167[.]996 172[.]217[.]21[.]1646 23[.]0[.]18[.]1236 84[.]201[.]152[.]2206 104[.]47[.]53[.]364 20[.]70[.]246[.]204 87[.]240[.]129[.]1353
*See JSON for more IOCs
Domain Names contacted by malware. Does not indicate maliciousness Occurrences 249[.]5[.]55[.]69[.]in-addr[.]arpa14 www[.]google[.]com14 vanaheim[.]cn14 249[.]5[.]55[.]69[.]bl[.]spamcop[.]net13 249[.]5[.]55[.]69[.]cbl[.]abuseat[.]org13 249[.]5[.]55[.]69[.]dnsbl[.]sorbs[.]net13 249[.]5[.]55[.]69[.]sbl-xbl[.]spamhaus[.]org13 249[.]5[.]55[.]69[.]zen[.]spamhaus[.]org13 i[.]instagram[.]com13 microsoft-com[.]mail[.]protection[.]outlook[.]com13 microsoft[.]com13 www[.]instagram[.]com13 www[.]evernote[.]com10 steamcommunity[.]com7 www[.]tiktok[.]com6 t[.]me6 api[.]steampowered[.]com6 www[.]youtube[.]com4 oauth[.]vk[.]com4 identity[.]bitwarden[.]com4 www[.]ebay[.]co[.]uk3 api[.]vk[.]com3 ustawienia[.]poczta[.]onet[.]pl3 work[.]a-poster[.]info2 api[.]twitter[.]com2
*See JSON for more IOCs
Files and or directories created Occurrences %SystemRoot%\SysWOW64\14 %SystemRoot%\SysWOW64\config\systemprofile13 %SystemRoot%\SysWOW64\config\systemprofile:.repos13 %TEMP%\.exe 12 %ProgramData%\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.Lck1 %TEMP%\qzfqodv.exe1 %TEMP%\foufdsk.exe1
File Hashes 03408910e1c86cc056f6135cb25bfdce0a3530c3dedd2d96dc6a40602f837c25
Coverage
Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella WSA
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Dropper.Glupteba-10013467-0 Indicators of Compromise IOCs collected from dynamic analysis of 12 samples Registry Keys Occurrences \SOFTWARE\MICROSOFT\A1890984 Value Name: PatchTime 12 \SOFTWARE\MICROSOFT\A1890984 Value Name: PGDSE 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXWDDM Value Name: DisplayName 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXWDDM Value Name: WOW64 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXWDDM Value Name: ObjectName 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXSF Value Name: Type 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXSF Value Name: Start 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXSF Value Name: ErrorControl 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXSF Value Name: ImagePath 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXSF Value Name: DisplayName 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXSF Value Name: WOW64 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXSF Value Name: ObjectName 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXMOUSE Value Name: Type 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXMOUSE Value Name: Start 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXMOUSE Value Name: ErrorControl 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXMOUSE Value Name: ImagePath 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXMOUSE Value Name: DisplayName 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXMOUSE Value Name: WOW64 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXMOUSE Value Name: ObjectName 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXGUEST Value Name: Type 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXGUEST Value Name: Start 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXGUEST Value Name: ErrorControl 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXGUEST Value Name: ImagePath 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXGUEST Value Name: DisplayName 12 \SYSTEM\CONTROLSET001\SERVICES\VBOXGUEST Value Name: WOW64 12
Mutexes Occurrences Global\SetupLog12 Global\WdsSetupLogInit12 Global\h48yorbq6rm87zot12 WininetConnectionMutex12 Global\qtxp9g8w12 Global\xmrigMUTEX313376
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 204[.]79[.]197[.]21912 20[.]150[.]79[.]689 104[.]21[.]23[.]1848 20[.]150[.]38[.]2286 142[.]250[.]15[.]1275 20[.]150[.]70[.]365 162[.]159[.]134[.]2334 172[.]67[.]212[.]1884 185[.]82[.]216[.]1044 162[.]159[.]130[.]2333 3[.]33[.]249[.]2483 185[.]82[.]216[.]1083 185[.]82[.]216[.]1113 162[.]159[.]133[.]2332 162[.]159[.]129[.]2332 74[.]125[.]128[.]1272 172[.]253[.]120[.]1272 185[.]82[.]216[.]962 162[.]159[.]135[.]2331 81[.]3[.]27[.]441 142[.]250[.]112[.]1271 142[.]250[.]144[.]1271
Domain Names contacted by malware. Does not indicate maliciousness Occurrences msdl[.]microsoft[.]com12 vsblobprodscussu5shard35[.]blob[.]core[.]windows[.]net12 vsblobprodscussu5shard60[.]blob[.]core[.]windows[.]net12 cdn[.]discordapp[.]com12 walkinglate[.]com12 stun1[.]l[.]google[.]com5 stun[.]sipgate[.]net3 79102df1-5f9d-4ca9-bdf6-1fa1060285b4[.]uuid[.]createupdate[.]org3 stun4[.]l[.]google[.]com2 stun3[.]l[.]google[.]com2 79102df1-5f9d-4ca9-bdf6-1fa1060285b4[.]uuid[.]alldatadump[.]org2 79102df1-5f9d-4ca9-bdf6-1fa1060285b4[.]uuid[.]localstats[.]org2 server10[.]alldatadump[.]org2 stun[.]l[.]google[.]com1 stun[.]stunprotocol[.]org1 stun2[.]l[.]google[.]com1 stun[.]ipfire[.]org1 79102df1-5f9d-4ca9-bdf6-1fa1060285b4[.]uuid[.]filesdumpplace[.]org1 79102df1-5f9d-4ca9-bdf6-1fa1060285b4[.]uuid[.]allstatsin[.]ru1 server3[.]statscreate[.]org1 79102df1-5f9d-4ca9-bdf6-1fa1060285b4[.]uuid[.]statscreate[.]org1 79102df1-5f9d-4ca9-bdf6-1fa1060285b4[.]uuid[.]theupdatetime[.]org1 79102df1-5f9d-4ca9-bdf6-1fa1060285b4[.]uuid[.]myfastupdate[.]org1 server3[.]createupdate[.]org1 server1[.]myfastupdate[.]org1
*See JSON for more IOCs
Files and or directories created Occurrences %SystemRoot%\Logs\CBS\CBS.log12 %SystemRoot%\rss12 %SystemRoot%\rss\csrss.exe12 %TEMP%\csrss12 %TEMP%\csrss\dsefix.exe12 %TEMP%\csrss\patch.exe12 %System32%\drivers\Winmon.sys12 %System32%\drivers\WinmonFS.sys12 %System32%\drivers\WinmonProcessMonitor.sys12 %SystemRoot%\windefender.exe12 %TEMP%\Symbols12 %TEMP%\Symbols\ntkrnlmp.pdb12 %TEMP%\Symbols\ntkrnlmp.pdb\9E22A5947A15489895CE716436B45BE0212 %TEMP%\Symbols\ntkrnlmp.pdb\9E22A5947A15489895CE716436B45BE02\download.error12 %TEMP%\Symbols\pingme.txt12 %TEMP%\Symbols\winload_prod.pdb12 %TEMP%\Symbols\winload_prod.pdb\B7B16B17E078406E806A050C8BEE2E36112 %TEMP%\Symbols\winload_prod.pdb\B7B16B17E078406E806A050C8BEE2E361\download.error12 %TEMP%\dbghelp.dll12 %TEMP%\ntkrnlmp.exe12 %TEMP%\osloader.exe12 %TEMP%\symsrv.dll12 %TEMP%\csrss\DBG0.tmp12 %System32%\Tasks\csrss12 %TEMP%\csrss\injector12
*See JSON for more IOCs
File Hashes 053421a64d181eacb1e3c1bb16e87107462a32c11c91c7f77059adf82198dd4a
Coverage
Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella WSA
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Downloader.Upatre-10013406-0 Indicators of Compromise IOCs collected from dynamic analysis of 67 samples IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 104[.]18[.]114[.]9736 104[.]18[.]115[.]9730 95[.]143[.]141[.]501 68[.]55[.]59[.]1451 37[.]57[.]144[.]1771
Domain Names contacted by malware. Does not indicate maliciousness Occurrences icanhazip[.]com66
Files and or directories created Occurrences %TEMP%\murzuja.exe66
File Hashes 02627c827c7ed7cb06e0b8b8579f09d41309a34dedc21f6cbfda0c4ad111e633
Coverage
Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella N/A WSA N/A
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Win.Malware.Diztakun-10013372-0 Indicators of Compromise IOCs collected from dynamic analysis of 25 samples Registry Keys Occurrences \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: DisableTaskMgr 25 \SYSTEM\CONTROLSET001\SERVICES\SR Value Name: Start 25 \SYSTEM\CONTROLSET001\SERVICES\WUAUSERV Value Name: Start 25 \SOFTWARE\POLICIES\MICROSOFT\WINDOWS\INSTALLER Value Name: DisableMSI 25 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN 25 \SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY 25 \SOFTWARE\POLICIES\MICROSOFT\WINDOWS\INSTALLER 25 \SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSERVICES 25 \SOFTWARE\POLICIES\MICROSOFT\WINDOWSFIREWALL 25 \SYSTEM\CONTROLSET001\SERVICES\SR 25 \SYSTEM\CONTROLSET001\SERVICES\ALERTER 25 \SYSTEM\CONTROLSET001\SERVICES\ALERTER Value Name: Start 25 \SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: DisableCAD 25 \SOFTWARE\CLASSES\WINRAR 25 \SOFTWARE\CLASSES\WINRAR\SHELL 25 \SOFTWARE\CLASSES\WINRAR\SHELL\OPEN 25 \SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: SFCDisable 25 \SOFTWARE\POLICIES\INTERNET EXPLORER 25 \SOFTWARE\POLICIES\INTERNET EXPLORER\CONTROLPANEL 25 \SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\WINDOWSUPDATE 25 \SOFTWARE\CLASSES\FILTER 25 \SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\DESKTOP 25 \SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\DESKTOP\COMPONENTS 25 \SOFTWARE\WOW6432NODE\MICROSOFT\CTF\LANGBARADDIN 25 \SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHAREDTASKSCHEDULER 25
Mutexes Occurrences Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!010a025 Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!011ba425 Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!012c2c25 Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!014d3c25
Files and or directories created Occurrences %SystemRoot%\system.ini25 \TEMP\autorun.inf25 \config.sys25 %SystemRoot%\winstart.bat25 \autoexec.bat25 \TEMP\winlogon.exe25 \TEMP\AGENT.exe25 \TEMP\SLEEP_TEST.sys25 \TEMP\SPOOKY.sys25 \TEMP\VAGRANT.exe25 \TEMP\VIRUS.txt25 \TEMP\wininit.ini25 %SystemRoot%\dosstart.bat25 %System16%\autoexec.nt25 %System16%\config.nt25
File Hashes 0021a7ecd30ec9e7d784c42ae64271b6048666c0a24505f7b35ef6398c6e67de
Coverage
Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security N/A Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella N/A WSA N/A
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK Doc.Malware.Valyria-10013349-0 Indicators of Compromise IOCs collected from dynamic analysis of 13 samples Registry Keys Occurrences \SOFTWARE\WOW6432NODE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\RECOVER Value Name: Name 13 \SOFTWARE\WOW6432NODE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\RECOVER Value Name: Path 13 \SOFTWARE\WOW6432NODE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\RECOVER Value Name: Extensions 13 \SOFTWARE\WOW6432NODE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WRDPRFCTDOS Value Name: Name 13 \SOFTWARE\WOW6432NODE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WRDPRFCTDOS Value Name: Path 13 \SOFTWARE\WOW6432NODE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WRDPRFCTDOS Value Name: Extensions 13 \SOFTWARE\WOW6432NODE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WORDPERFECT6X Value Name: Name 13 \SOFTWARE\WOW6432NODE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WORDPERFECT6X Value Name: Path 13 \SOFTWARE\WOW6432NODE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WORDPERFECT6X Value Name: Extensions 13
Mutexes Occurrences Local\10MU_ACB10_S-1-5-5-0-6786313 Local\10MU_ACBPIDS_S-1-5-5-0-6786313 Local\WinSpl64To32Mutex_10960_0_300013
Files and or directories created Occurrences %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0000.doc13 %TEMP%\.tmp 13 %TEMP%\tst69.tmp1 %TEMP%\tstF7.tmp1
File Hashes 000b51af496336d202cf40f4b0afa91ab678962705825d49d53454915b0fd651
Coverage
Product Protection Secure Endpoint Cloudlock N/A CWS Email Security Network Security N/A Stealthwatch N/A Stealthwatch Cloud N/A Secure Malware Analytics Umbrella N/A WSA N/A
Screenshots of Detection Secure Endpoint Secure Malware Analytics MITRE ATT&CK
文章来源: https://blog.talosintelligence.com/threat-roundup-1103-1110/
