Overview

overview

10

Static

static

invoice_or...st.exe

windows7_x64

10

invoice_or...st.exe

windows10_x64

10

Analysis

  • max time kernel
    134s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    03-08-2020 12:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    invoice_order0045234_last.exe

  • Size

    232KB

  • MD5

    9ff1bb99a84f6efa175b721a37d14af7

  • SHA1

    ae9707f52f46ef38f686d755b22ad3a2d041e3cf

  • SHA256

    8b79bc15e6fa66285b46d5859e9c3fd784ec3b0dd7bcc41becd0b2b1a864cdf9

  • SHA512

    836c0a584fa255ca69dc1f6df2cb81ab0788bf2ad3306d3f95ba1963293066b2dc3c297c965ef0d13f41e105110ce75aa2aa6f3c209f9db6a8a52fe3aea68d80

Score
10/10
bankertrojangozi_ifsbursnifspyware

Malware Config

Signatures

  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 61 IoCs
    adwarespyware
  • Drops file in System32 directory 1 IoCs
  • Ursnif, Dreambot

    Ursnif is a variant of the Gozi IFSB with more capabilities.

    bankertrojanursnif
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of WriteProcessMemory 62 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Deletes itself 1 IoCs
  • Checks whether UAC is enabled 5 IoCs
  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    PID:1296
    • C:\Users\Admin\AppData\Local\Temp\invoice_order0045234_last.exe
      "C:\Users\Admin\AppData\Local\Temp\invoice_order0045234_last.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:316
    • C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\CAF07543-A1A9-8CB6-7B9E-6580DFB269B4\\\Clicring'));if(!window.flag)close()</script>"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\CAF07543-A1A9-8CB6-7B9E-6580DFB269B4").comsclen))
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: MapViewOfSection
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        PID:1716
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xkgkob5a\xkgkob5a.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:800
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC2.tmp" "c:\Users\Admin\AppData\Local\Temp\xkgkob5a\CSC4C3C0FBE3038456C84B968AF4191CFD.TMP"
            5⤵
              PID:1804
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bp44dus3\bp44dus3.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:580
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC4F.tmp" "c:\Users\Admin\AppData\Local\Temp\bp44dus3\CSCF4AE38216AFA41AB91C05821FB8732B8.TMP"
              5⤵
                PID:1308
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\invoice_order0045234_last.exe"
          2⤵
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          • Suspicious use of SetThreadContext
          • Deletes itself
          PID:1896
          • C:\Windows\system32\PING.EXE
            ping localhost -n 5
            3⤵
            • Runs ping.exe
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:1084
        • C:\Windows\system32\cmd.exe
          cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\140C.bi1"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1660
          • C:\Windows\system32\nslookup.exe
            nslookup myip.opendns.com resolver1.opendns.com
            3⤵
              PID:1796
          • C:\Windows\system32\cmd.exe
            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\140C.bi1"
            2⤵
              PID:1488
            • C:\Windows\syswow64\cmd.exe
              "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
              2⤵
                PID:2040
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
              1⤵
              • Suspicious use of FindShellTrayWindow
              • Modifies Internet Explorer settings
              • Suspicious use of WriteProcessMemory
              • Suspicious use of SetWindowsHookEx
              • Checks whether UAC is enabled
              PID:756
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:275457 /prefetch:2
                2⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                • Checks whether UAC is enabled
                PID:1820
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:537609 /prefetch:2
                2⤵
                  PID:1704
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                1⤵
                • Suspicious use of FindShellTrayWindow
                • Modifies Internet Explorer settings
                • Suspicious use of WriteProcessMemory
                • Suspicious use of SetWindowsHookEx
                • Checks whether UAC is enabled
                PID:1920
                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:275457 /prefetch:2
                  2⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of SetWindowsHookEx
                  • Checks whether UAC is enabled
                  PID:2004
                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:537612 /prefetch:2
                  2⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of SetWindowsHookEx
                  • Checks whether UAC is enabled
                  PID:660

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/316-1-0x0000000002330000-0x0000000002341000-memory.dmp

                Filesize

                68KB

                Download

              • memory/316-0-0x0000000000B2B000-0x0000000000B2C000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1820-3-0x0000000006730000-0x0000000006753000-memory.dmp

                Filesize

                140KB

                Download

              • memory/2004-9-0x0000000006920000-0x0000000006943000-memory.dmp

                Filesize

                140KB

                Download