Overview

overview

10

Static

static

pliant.dll

windows7_x64

10

pliant.dll

windows10_x64

10

Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    11-06-2020 15:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    pliant.dll

  • Size

    270KB

  • MD5

    019c152a88c2efc4c7b42458a48f7f5c

  • SHA1

    1e6cc277d46f5fd5e7b915980deb8725c4a71726

  • SHA256

    d8885ce1f08167becda151811c6519af1bac2ad835acf60c7fa1130dad28fcd7

  • SHA512

    15457c7e7406aacf90bcdb281c3b00fc0f37923dfe660f23c4889a48091f877de6f7662bc13ee7c68cb6bb7bb39c1973d71ad4a8b50769893978c5163a64cfad

Score
10/10
bankertrojangozi_ifsbursnifspyware

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Ursnif, Dreambot

    Ursnif is a variant of the Gozi IFSB with more capabilities.

    bankertrojanursnif
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of WriteProcessMemory 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Deletes itself 1 IoCs
  • Checks whether UAC is enabled 3 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    PID:1284
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\pliant.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\pliant.dll,#1
        3⤵
          PID:1404
      • C:\Windows\System32\mshta.exe
        "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05\\\Efsltprf'));if(!window.flag)close()</script>"
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:1652
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05").dmrctcls))
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetThreadContext
          PID:432
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wml2pt21\wml2pt21.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1876
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBBA0.tmp" "c:\Users\Admin\AppData\Local\Temp\wml2pt21\CSCF5E2402943C9449CAD4C624F8EE5815B.TMP"
              5⤵
                PID:1544
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jcqc2x1d\jcqc2x1d.cmdline"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1916
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD84.tmp" "c:\Users\Admin\AppData\Local\Temp\jcqc2x1d\CSC5F1D218621324F4BA6785E81D9842C4.TMP"
                5⤵
                  PID:1924
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\pliant.dll"
            2⤵
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            • Suspicious use of SetThreadContext
            • Deletes itself
            PID:2028
            • C:\Windows\system32\PING.EXE
              ping localhost -n 5
              3⤵
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Runs ping.exe
              PID:896
          • C:\Windows\system32\cmd.exe
            cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\2C0C.bi1"
            2⤵
              PID:1908
              • C:\Windows\system32\nslookup.exe
                nslookup myip.opendns.com resolver1.opendns.com
                3⤵
                  PID:1456
              • C:\Windows\system32\cmd.exe
                cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\2EEC.bi1"
                2⤵
                  PID:1600
                  • C:\Windows\system32\nslookup.exe
                    nslookup myip.opendns.com resolver1.opendns.com
                    3⤵
                      PID:1472
                  • C:\Windows\system32\cmd.exe
                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2C0C.bi1"
                    2⤵
                      PID:1032
                    • C:\Windows\system32\cmd.exe
                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2EEC.bi1"
                      2⤵
                        PID:480
                    • C:\Program Files\Internet Explorer\iexplore.exe
                      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                      1⤵
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      • Checks whether UAC is enabled
                      • Suspicious use of FindShellTrayWindow
                      PID:1844
                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:2
                        2⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of SetWindowsHookEx
                        • Checks whether UAC is enabled
                        PID:1196
                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:406535 /prefetch:2
                        2⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of SetWindowsHookEx
                        • Checks whether UAC is enabled
                        PID:1908

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/432-12-0x000000001C480000-0x000000001C531000-memory.dmp

                      Filesize

                      708KB

                      Download

                    • memory/896-17-0x0000000000180000-0x0000000000181000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1196-0-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1284-16-0x0000000007BA0000-0x0000000007C51000-memory.dmp

                      Filesize

                      708KB

                      Download

                    • memory/1284-14-0x0000000007BA0000-0x0000000007C51000-memory.dmp

                      Filesize

                      708KB

                      Download

                    • memory/1284-11-0x00000000026C0000-0x00000000026C1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1844-13-0x0000000002D50000-0x0000000002D51000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/2028-18-0x0000000001CD0000-0x0000000001D81000-memory.dmp

                      Filesize

                      708KB

                      Download

                    • memory/2028-15-0x0000000000110000-0x0000000000111000-memory.dmp

                      Filesize

                      4KB

                      Download