IOC Report
KEQprG0zDB.exe

Files

File Path

Type

Category

Malicious

KEQprG0zDB.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

C:\ProgramData\BGIIDAEBGCAAECAKFHII

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\ProgramData\EBGIEGCFHCFHIDHIJECA

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2

dropped

C:\ProgramData\GDHIEHJEBAAFIDHJEBGIEBFIJK

SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6

dropped

C:\ProgramData\GHJDBAKE

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8

dropped

C:\ProgramData\IIJDBAKKKFBFHIDGIIEHIDBGCA

SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7

dropped

C:\ProgramData\KJDGIJEC

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\ProgramData\freebl3.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\ProgramData\mozglue.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\ProgramData\msvcp140.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\ProgramData\nss3.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\ProgramData\softokn3.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\ProgramData\vcruntime140.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

There are 9 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\KEQprG0zDB.exe

"C:\Users\user\Desktop\KEQprG0zDB.exe"

Details

Is windows:	false
Is dropped:	false
PID:	416
Target ID:	0
Parent PID:	4004
Name:	KEQprG0zDB.exe
Path:	C:\Users\user\Desktop\KEQprG0zDB.exe
Commandline:	"C:\Users\user\Desktop\KEQprG0zDB.exe"
Size:	2835984
MD5:	2BEF62A4BC86DF703A49213669930FDD
Time:	16:21:59
Date:	01/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xe30000
Modulesize:	2056192
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Powershell download and execute	HIPS / PFW / Operating System Protection Evasion
Machine Learning detection for sample	AV Detection
Yara detected Costura Assembly Loader	Data Obfuscation
PE / OLE file has an invalid certificate	System Summary
PE file contains an invalid checksum	Data Obfuscation
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Details

Is windows:	true
Is dropped:	false
PID:	2656
Target ID:	5
Parent PID:	416
Name:	MSBuild.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Size:	262432
MD5:	8FDF47E0FF70C40ED3A17014AEEA4232
Time:	16:22:19
Date:	01/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xc60000
Modulesize:	262144
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Powershell download and execute	HIPS / PFW / Operating System Protection Evasion
Yara detected Stealc	Stealing of Sensitive Information, Remote Access Functionality
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Silenttrinity Stager Msbuild Activity	System Summary
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

http://217.138.215.82/ec72081014d386e4/vcruntime140.dll

217.138.215.82

http://217.138.215.82/

217.138.215.82

http://217.138.215.82/ec72081014d386e4/softokn3.dll

217.138.215.82

http://217.138.215.82/ec72081014d386e4/mozglue.dll

217.138.215.82

http://217.138.215.82/ec72081014d386e4/nss3.dll

217.138.215.82

http://217.138.215.82/ec72081014d386e4/freebl3.dll

217.138.215.82

http://217.138.215.82

unknown

http://217.138.215.82/ec72081014d386e4/sqlite3.dll

217.138.215.82

http://217.138.215.82/ec72081014d386e4/msvcp140.dll

217.138.215.82

http://217.138.215.82/8c77d85de581124b.php

217.138.215.82

http://217.138.2

unknown

http://217.138.215.82/ec72081014d386e4/msvcp140.dlli

unknown

https://duckduckgo.com/chrome_newtab

unknown

http://217.138.215.82/ec72081014d386e4/nss3.dllser

unknown

http://217.138.215.82/ec72081014d386e4/softokn3.dll1

unknown

https://duckduckgo.com/ac/?q=

unknown

https://github.com/mgravell/protobuf-netJ

unknown

http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0

unknown

http://ocsp.sectigo.com0

unknown

http://217.138.215.82/ec72081014d386e4/mozglue.dllO

unknown

http://217.138.215.82/ec72081014d386e4/Softwareer

unknown

http://217.138.215.82/ec72081014d386e4/vcruntime140.dll1014d386e4/nss3.dll

unknown

http://217.138.215.82/ec72081014d386e4/msvcp140.dllu

unknown

http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#

unknown

http://217.138.215.82/8c77d85de581124b.phpdge

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#

unknown

http://217.138.215.82/ec72081014d386e4/mozglue.dll33e6ea656ba6edffae7a9tionComponentcal

unknown

http://217.138.215.82/ec72081014d386e4/mozglue.dll=

unknown

http://217.138.215.82ec72081014d386e4/sqlite3.dllnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZG

unknown

http://217.138.215.82/8c77d85de581124b.phptware

unknown

http://217.138.215.82/ec72081014d386e4/sqlite3.dllQ

unknown

http://217.138.215.82/ec72081014d386e4/nss3.dll9

unknown

http://217.138.215.828c77d85de581124b.phprowser

unknown

https://github.com/mgravell/protobuf-neti

unknown

http://217.138.215.82/ec72081014d386e4/mozglue.dllera

unknown

http://217.138.215.82/ec72081014d386e4/mozglue.dll/

unknown

https://stackoverflow.com/q/11564914/23354;

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown