404: DFIR

Showing posts with label DFIR. Show all posts

Tuesday, November 5, 2013

FedEx Phishing Campaign (Zbot)

FedEx Phishing Campaign

At the time I pulled this sample it was 8 hours old on VirusTotal. It did not appear to be specific to any industry and minimal changes had been changed to the PE to evade detection.

Details are as follows:

118.21.162.237 (i118-21-162-237.s30.a048.ap.plala.or.jp)
Tokyo 40 Japan
Delivery: SMTP
exe
37.0 KB
61740 -> 25 (SMTP)
TCP Client to TCP Server
Trojan.Win32.Agent.acqpl TROJWARE (zbot)
Agent acqpl

Other Country Sources:

http://pastebin.com/RJi9XqX5

Email:

mime(Order history page.zip.b64) base64(Order history page.zip) zip(Order history page.pdf.exe)

i118-21-162-237.s30.a048.ap.plala.or.jp mail.company.com BODY=7BIT BODY=7BIT

Subject: Your Rewards Order Has Shipped

Body

ontent-Type: text/plain; charset=windows-1250.

Content-Transfer-Encoding: 7bit.

This is to confirm that one or more items in your order has been shipped. ..Note that multiple items in an order may be shipped separately.....

You can review complete details of your order on the ..Order History page ..........

hanks for choosing FedEx.....

Order Confirmation Number: ..3899836....

Order Date: ..11/03/2013....

Redemption Item...Quantity...Tracking Number....

Paper, Document16.

fedex.com...

Follow FedEx

You may receive separate e-mails with tracking ..information for reward ord ered...

My FedEx Rewards may be modified or terminated at any time ..without notice . Rewards points available for qualifying purchases and certain exclusions apply . For details and ..a complete listing of eligible products and services please read ..My FedEx Rewards Terms and Conditions.........

2012 FedEx. The content of this message is ..protected by copyright and tr

Malwr

https://malwr.com/analysis/NmMxNTg3YTgzZjVjNGUyMjg3YzkyMWQzY2I5NGZkNjA/

VirusTotal

https://www.virustotal.com/en/file/a8a7268cbb0d6a534978ff5771bb779b6b77e01b1458945133841df72b5ab99e/analysis/

Forensic Data (Text)

MZ ÿÿ @ @

$ PE L 1⁄2[cB à

Z 0 @ à.code a

`.data $E 0 F !Àá èÓ É&ÉF&l2BÉF&

o ́Í! ̧LÍ!This program cannot be run in DOS mode. : ä;

.text <

Ð ùÄ @à.idata:

R @À.rsrc ä; < X

\2BÉF&

ÉF&ÉF&ÉF&ÉF&ÂÉF&"ÉF&&£2BF&*ÉF&.Bî2ÂvqÉ&2BÉF&ÉF&

ÉF&BîútDwÓllja2B4B¥T2Bjq2B7T2Bê©j2BÒîÉ&2BBîíË£

2B&âBWçîÉGþGþêËÅRÉÀa2BqBKuB3R@AIHHHR¬aZäõ3\+Òîl72BòB\+ÄTlljR2Bj22BB\+ÄÅ3Â\Å

êiqêhqêSqêJqWçUXYîj#2B7X2BêÕ¥4BGúvX?v RZ?ví 2Bí2B?2BvíêDG

&GF&GF&

GF&BÆíÉ&¢BÆ3ÂÆa`]ËÄ?2BwK7qB7qBjÚB7qBl

RÞB¥2B£2Bê 2BÉëèÄÔRÅWçî

hAO\wgüY>h

GúB"G

Gþ3ËWú=L<_ div="">

wUê2úvCíàGúB&G

3ÝhJGúBG

í3Âî_Ä

UF&

^&vF&F&

íæoío]Ä

vvRBVBZB^BÅ~BlBlBl¦Ba@ ÿ¬@ j ÿ°@ ÿ ́@ ÿ ̧@ ÿ1⁄4@ j ÿÀ@ ÿÄ@ ÿ@ ÿ`@ j ÿd@ ÿh@ ÿl@ j ÿp@ ÿt@ j ÿx@ ÿ@ ÿ@ j ÿ@ ÿ@ j Ã1ÿWjhP0@ h00@ ÿ@ = tÃ3⁄4 @ ÷j[d 0 Qj 1@ (ØaFâøD$Á@Ã@Ë @£V0@ ÄÃ

ì4j j ÿÈ@ h 1ÀPÌ@ ÿÒ£0@ »0@ Ç0@ @ ì ̧ Pj ÿÈ@ ì£0@ SÿÐ@ ìè¦ïÿÿë¤ÀUå

LoadLibraryExA record recsound c:\\ere\ereaaaa c FTPR user32.dll CLSS TranslateMessage @ j0@ éà áà ýà ûà ûà áà 4à Ià @à «à à 1à Þà ;à «à äà :à à ûà ûà ûà ûà #à ûà ûà {à à ûà ûà Pà à àà à pà à à @à à ,à Íà ,à Öà ®à ÿà òà îà à 1⁄4à Là à Hà à à @à à à Pà à $à Ëà Ýà ÷à Tà à à ,à 1⁄2à à Xà à $à Õà $à 3⁄4à 1⁄4à Ãà à à @à à à Xà à à à ~à Áà ÿà Ýà àà Äà 1⁄2à à ûà Pà à àà à pà à à xà à à Hà à ,à Íà à à à à à

--- CUT----

DFIR:

MAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_READ

c13cf0af350fd6dfb8380d0968c23 0b1.exe

filename: slide1.exe

Callbacks:

103[.]6[.]196[.]152

TCP

GET hxxp://asfitness[.]com:80/wp-content/uploads/2013/04/ourgoals.exe

request (dropper)

x-pingback

hxxp://www[.]asfitness.com/xmlrpc[.]php

x-powered-by PHP/5.3.27

location hxxp://www[.]asfitness[.]com/wp-content/uploads/2013/04/ourgoals.exe

content-length 0

server Apache

69[.]64[.]39[.]215

80 TCP

GET hxxp://dominionthe[.]com:80/images/slide1.exe

dominionthe[.]com

user-agent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;)

content-length 441856

server Apache

99[.]35[.]113[.]22 8610

70[.]52[.]185[.]81 1044

109[.]152[.]163[.]147 9819

86[.]46[.]238[.]128 8274

178[.]131[.]179[.]64 6295

71[.]35[.]90[.]194 7606

59[.]99[.]73[.]77 9084

79[.]23[.]23[.]228 7377

141[.]0[.]97[.]49 5609

82[.]107[.]157[.]227 2186

150[.]212[.]189[.]200 1685

99[.]123[.]8[.]127 4870

139[.]195[.]227.57

2./228/.19./149 6356

84./140/.161/.152 4019

176/.73/.200/.140 5014

213/.123./216./113 8730

70/.246/.10./226 2276

2./135./143/.98 2696

108./237/.184/.77

80./11/.166/.26 1172

82./89./225./96 8310

70./30./53./56 8204

176./73/.230/.38 1153

201/.174/.194/.198 5552

58./97./166./89 2466

2./229./105./13 8381

217/.27./102/.96 6308

80./141./251./252 8581

190/.201/.1./139 9466

217./92./114/.216 1981

95./104./86./31 8251

78./15./147./55

75./146./121./185 3413

77./107./154./122 4450

79./19./139./88 6301

46./44./133./57 5717

Process activity after target sample started. lsass.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\lsass.exe

Mon Nov 04 2013 10:22:41 UTC C:\WINDOWS\system32\

C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\lsass.exe

Processes Name: lsass.exe

\lsass

Page 21

Name: svchost.exe

PID: Child Count: File Actions: Registry Actions: Analysis Reason: Process Name: Image Filename: Command Line: Children: New: Started At: Current Directory: Image Base Address: Window Title: Shell Info: Desktop Info:

748

Process activity after target sample started. svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs

Mon Nov 04 2013 10:22:42 UTC C:\WINDOWS\system32\

C:\WINDOWS\System32\svchost.exe

Artifacts

ID Path

16 748-svchost.exe

File Activity Action Path Modified

\ROUTER

Modified

\WINDOWS\Prefetch\CMD.EXE-087B4001.pf

Registry Activity: Created Registry Keys

Created Key

Access List

Option List

REGISTRY\USER\S-1-5-21-1202660629-583907252- 1801674531- 1003\SOFTWARE\MICROSOFT\MULTIMEDIA\AUDIO COMPRESSION MANAGER\MSACM

CREATE_SUB_KEY,ENUMERATE_SUB_KEYS,QUERY_ VALUE,READ_CONTROL,NOTIFY,SET_VALUE

REG_OPTION_N ON_VOLATILE

REGISTRY\USER\S-1-5-21-1202660629-583907252- 1801674531- 1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Inte rnet Settings

CREATE_SUB_KEY,ENUMERATE_SUB_KEYS,QUERY_ VALUE,READ_CONTROL,NOTIFY,SET_VALUE

REG_OPTION_N ON_VOLATILE

Registry Activity: Modified Registry Keys

Modified Key

Value Name

Data Type

Data

REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDO WS NT\CURRENTVERSION\PREFETCHER

TracesProces sed

DWORD_LIT TLE_ENDIAN

REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDO WS NT\CURRENTVERSION\PREFETCHER

TracesSucce ssful

DWORD_LIT TLE_ENDIAN

REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDO WS NT\CURRENTVERSION\PREFETCHER

LastTraceFail ure

DWORD_LIT TLE_ENDIAN

REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDO WS NT\CURRENTVERSION\PREFETCHER

TracesProces sed

DWORD_LIT TLE_ENDIAN

REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}

DhcpRetrySta tus

DWORD_LIT TLE_ENDIAN

REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}

DhcpDefaultG ateway

MULTI_SZ

172.16.1.1

REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP

DhcpDefaultG ateway

MULTI_SZ

172.16.1.1

REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS

DhcpNameSe rver

172.16.1.1

REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}

DhcpNameSe rver

172.16.1.1

REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\TCPIP\PARAMETERS\INTERFACES\{C20FDDB0- BD90-4E06-8D7A-87767A382393}

DhcpSubnet MaskOpt

MULTI_SZ

255.255.0.0

REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\{C20FDDB0-BD90-4E06-8D7A- 87767A382393}\PARAMETERS\TCPIP

DhcpSubnet MaskOpt

MULTI_SZ

255.255.0.0 Page 22

Details for Alert ID 67540517

{C20FDDB0- BD90-4E06- 8D7A- 87767A38239 3}

BINARY

DhcpIPAddre ss

DhcpSubnet Mask

DhcpServer

Lease

DWORD_LIT TLE_ENDIAN

Lease

DWORD_LIT TLE_ENDIAN

LeaseObtaine dTime

DWORD_LIT TLE_ENDIAN

LeaseObtaine dTime

DWORD_LIT TLE_ENDIAN

LeaseTermin atesTime

DWORD_LIT TLE_ENDIAN

LeaseTermin atesTime

DWORD_LIT TLE_ENDIAN

IPAutoconfigu rationAddress

IPAutoconfigu rationMask

IPAutoconfigu rationSeed

DWORD_LIT TLE_ENDIAN

AddressType

DWORD_LIT TLE_ENDIAN

IsServerNapA ware

DWORD_LIT TLE_ENDIAN

DhcpRetrySta tus

DWORD_LIT TLE_ENDIAN

DhcpRetryTi me

DWORD_LIT TLE_ENDIAN

REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVI CES\DHCP\PARAMETERS