Threat Roundup for December 13 to December 20

2019-12-2010:07:43

[email protected] (William Largent)

feedproxy.google.com

133

JSON

Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between Dec. 13 and Dec. 20. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found herethat includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.
The most prevalent threats highlighted in this roundup are:

Threat Name	Type	Description
Doc.Downloader.Emotet-7451163-0	Downloader	Emotet is one of the most widely distributed and active malware families today. It is a highly modular threat that can deliver a wide variety of payloads. Emotet is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails.
Win.Dropper.TrickBot-7455405-0	Dropper	Trickbot is a banking trojan targeting sensitive information for certain financial institutions. This malware is frequently distributed through malicious spam campaigns. Many of these campaigns rely on downloaders for distribution, such as VB scripts.
Win.Packed.Dridex-7447905-1	Packed	Dridex is a well-known banking trojan that aims to steal credentials and other sensitive information from an infected machine.
Win.Packed.Razy-7450491-0	Packed	Razy is oftentimes a generic detection name for a Windows trojan. It collects sensitive information from the infected host and encrypt the data, and send it to a command and control (C2) server. Information collected might include screenshots. The samples modify auto-execute functionality by setting and creating a value in the registry for persistence.
Win.Dropper.NetWire-7454096-1	Dropper	NetWire is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam, remote desktop, and read data from connected USB devices. NetWire is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails.
Win.Trojan.Tofsee-7450732-0	Trojan	Tofsee is multi-purpose malware that features a number of modules used to carry out various activities such as sending spam messages, conducting click fraud, mining cryptocurrency and more. Infected systems become part of the Tofsee spam botnet and are used to send large volumes of spam messages in an effort to infect additional systems and increase the overall size of the botnet under the operator’s control.
Doc.Downloader.Sagent-7454309-0	Downloader	Sagent downloads and executes a binary using PowerShell from a Microsoft Word document.
Win.Malware.Gandcrab-7454521-1	Malware	Gandcrab is ransomware that encrypts documents, photos, databases and other important files using the file extension “.GDCB,” “.CRAB” or “.KRAB”. Gandcrab is spread through both traditional spam campaigns, as well as multiple exploit kits, including Rig and Grandsoft.
Win.Trojan.HawkEye-7455512-1	Trojan	Hawkeye is an information stealing malware that specifically targets usernames and passwords stored by web browsers and mail clients on an infected machine. It is commonly spread via email and can also propagate through removable media.

Threat Breakdown

Doc.Downloader.Emotet-7451163-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{BEF6E003-A874-101A-8BBA-00AA00300CAB}`	10
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}`	2
`<HKU>.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value Name: ProxyEnable `	2
`<HKU>.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value Name: ProxyServer `	2
`<HKU>.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value Name: ProxyOverride `	2
`<HKU>.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value Name: AutoConfigURL `	2
`<HKU>.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value Name: AutoDetect `	2
`<HKU>.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}
Value Name: WpadDecisionReason `	2
`<HKU>.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}
Value Name: WpadDecision `	2
`<HKU>.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}
Value Name: WpadNetworkName `	2
`<HKU>.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}
Value Name: WpadDetectedUrl `	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA
Value Name: Type `	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA
Value Name: Start `	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA
Value Name: ErrorControl `	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA
Value Name: ImagePath `	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA
Value Name: DisplayName `	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA
Value Name: WOW64 `	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA
Value Name: ObjectName `	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA
Value Name: Description `	2
`<HKU>.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}
Value Name: WpadDecisionTime `	2
`<HKCR>\TYPELIB\{C4EDCADC-BC75-481F-8A40-032075206B43}\2.0\FLAGS`	1
`<HKCR>\TYPELIB\{C4EDCADC-BC75-481F-8A40-032075206B43}\2.0\0`	1
`<HKCR>\TYPELIB\{C4EDCADC-BC75-481F-8A40-032075206B43}\2.0\0\WIN32`	1
Mutexes	Occurrences
—	—
`Global\I98B68E3C`	2
`Global\M98B68E3C`	2
IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
—	—
`100[.]108[.]65[.]228`	8
`100[.]116[.]148[.]111`	8
`100[.]112[.]136[.]191`	8
`100[.]89[.]177[.]62`	8
`100[.]93[.]135[.]190`	8
`168[.]235[.]82[.]183`	2
`96[.]234[.]38[.]186`	2
`120[.]51[.]83[.]89`	2
`204[.]197[.]244[.]176`	2
`149[.]202[.]153[.]251`	1
`103[.]47[.]185[.]215`	1
`107[.]180[.]41[.]254`	1
`69[.]16[.]254[.]127`	1
`82[.]145[.]43[.]153`	1
`139[.]255[.]47[.]211`	1
`37[.]228[.]137[.]204`	1
`157[.]7[.]231[.]227`	1
`202[.]238[.]198[.]32`	1
`202[.]238[.]198[.]30`	1
`60[.]36[.]166[.]212`	1
`192[.]1[.]4[.]230`	1
`50[.]31[.]174[.]165`	1
`113[.]43[.]208[.]199`	1
`202[.]130[.]62[.]24`	1
`103[.]253[.]113[.]131`	1

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`adichip[.]com`	10
`grafdesign[.]pl`	8
`dcjohnsonassociates[.]com`	8
`global-ark[.]co[.]jp`	8
`acadmi[.]co[.]uk`	8
`mail[.]1and1[.]com`	1
`587[.]hexabyte[.]tn`	1
`child-pro[.]com`	1
`imap[.]e-apamanshop[.]com`	1
`sg2plcpnl0259[.]prod[.]sin2[.]secureserver[.]net`	1
`mx1[.]retailconnection[.]co[.]za`	1
`smtp[.]consulmexrio[.]com[.]br`	1
`mail[.]ahg[.]com[.]mx`	1
`mail[.]cassado[.]com[.]pe`	1
`pop[.]aoishokai[.]co[.]jp`	1
`mail[.]thebasechurch[.]org`	1
`miyataseika[.]sakura[.]ne[.]jp`	1
`mail[.]uberved[.]com`	1
`mail[.]victoriasuitehotel[.]com[.]pe`	1
`pop3[.]jinrikiudon[.]co[.]jp`	1
`pop[.]e-apamanshop[.]com`	1
`bh-35[.]webhostbox[.]net`	1
`pop[.]orange[.]jo`	1
`mail[.]muzamilglass[.]com`	1
`mail[.]aceinterioruae[.]com`	1

*See JSON for more IOCs

Files and or directories created	Occurrences
`%HOMEPATH%\576.exe`	10
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat`	2

File Hashes

24547a6e7ab9766fc85644033e27414deb2409367fae21fdb722174a605a34ad 27e0a7b8c18893b22583e19ef7634fd79fc9cb5daed862f794960ddaa19b58dc 363ecad264cfe3cdef52119a1b78c495d362efa7df5d38d182ce76dbf31facfd 3f0e86777e4a9b3285a9203907f5a7e6f804e7cfda3300b857e8712ac2030e57 5e31045309ab5ecbef3701c9023fc5a4631bf653347447484b652e434b086966 67c3eabb23b74c1a6ee4d384fa6f248c4a2492d998e7aaf0a1ce3f878a8ff715 6ba2589b00a95ff4ce9f7eee550bdffa6ef57dbf0212384ce38696b0c13778bd 7b0c9b63d9e8c6399e13354176e41bde009c94053b0566ef4506b17c14b46ab7 9100a8c4f2f6dd2bde134162d6b70f0d9ac99db4ff1f4551407a8a078ce2c35c c0197a5e801dee8d80df024c32a616c04539a56108b2225b469c7eb5fede5447

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Malware