Overview

overview

10

Static

static

wJireyEV.tmp.exe

windows7_x64

10

wJireyEV.tmp.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    05-10-2020 15:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    wJireyEV.tmp.exe

  • Size

    322KB

  • MD5

    573b56ffd42efd390404133286ad691d

  • SHA1

    218f00d9ce955f2f196a93ae92a1588f6f1c1b36

  • SHA256

    19bcb38fae9b117b3e440f076fe7a7ebf169581dd89e3c5b8614f356ee2c4277

  • SHA512

    c054573268a4bcbf0a18a1d236250a66f07ba7e0f6b378e5ae3bfc2aa3e38211d99fd837b586af08dc052e10b64e1c1d984d5c4683dbff9014e7315aad352328

Score
10/10
trojanbackdoorsmokeloaderbankergozi_ifsbspywareursnif

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/
rc4.i32
rc4.i32

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Ursnif, Dreambot

    Ursnif is a variant of the Gozi IFSB with more capabilities.

    bankertrojanursnif
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
    adwarespyware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 722 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 170 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 141 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Deletes itself
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\wJireyEV.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\wJireyEV.tmp.exe"
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:240
    • C:\Users\Admin\AppData\Local\Temp\E975.tmp.exe
      C:\Users\Admin\AppData\Local\Temp\E975.tmp.exe
      2⤵
      • Executes dropped EXE
      PID:2004
    • C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\CAF07543-A1A9-8CB6-7B9E-6580DFB269B4\\\Clicring'));if(!window.flag)close()</script>"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\CAF07543-A1A9-8CB6-7B9E-6580DFB269B4").comsclen))
        3⤵
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1368
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iycdaqqb\iycdaqqb.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1544
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES50DE.tmp" "c:\Users\Admin\AppData\Local\Temp\iycdaqqb\CSCAC66561AB1A14548BB56923C3B4C70C2.TMP"
            5⤵
              PID:1500
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\olcn2r4z\olcn2r4z.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:672
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5199.tmp" "c:\Users\Admin\AppData\Local\Temp\olcn2r4z\CSC1862362C797F4418A89ABC619BDD8D5.TMP"
              5⤵
                PID:760
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\E975.tmp.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:316
          • C:\Windows\system32\PING.EXE
            ping localhost -n 5
            3⤵
            • Runs ping.exe
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:2024
        • C:\Windows\system32\cmd.exe
          cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\73DC.bi1"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1652
          • C:\Windows\system32\nslookup.exe
            nslookup myip.opendns.com resolver1.opendns.com
            3⤵
              PID:772
          • C:\Windows\system32\cmd.exe
            cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\70DC.bi1"
            2⤵
              PID:1640
              • C:\Windows\system32\nslookup.exe
                nslookup myip.opendns.com resolver1.opendns.com
                3⤵
                  PID:1636
              • C:\Windows\system32\cmd.exe
                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\73DC.bi1"
                2⤵
                  PID:1272
                • C:\Windows\system32\cmd.exe
                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\70DC.bi1"
                  2⤵
                    PID:1536
                  • C:\Windows\system32\cmd.exe
                    cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                    2⤵
                      PID:1756
                      • C:\Windows\system32\systeminfo.exe
                        systeminfo.exe
                        3⤵
                        • Gathers system information
                        PID:368
                    • C:\Windows\syswow64\cmd.exe
                      "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                      2⤵
                        PID:1820
                      • C:\Windows\system32\cmd.exe
                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                        2⤵
                          PID:908
                        • C:\Windows\system32\cmd.exe
                          cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                          2⤵
                            PID:1284
                            • C:\Windows\system32\net.exe
                              net view
                              3⤵
                              • Discovers systems in the same network
                              PID:1924
                          • C:\Windows\system32\cmd.exe
                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                            2⤵
                              PID:1272
                            • C:\Windows\system32\cmd.exe
                              cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                              2⤵
                                PID:1692
                                • C:\Windows\system32\nslookup.exe
                                  nslookup 127.0.0.1
                                  3⤵
                                    PID:568
                                • C:\Windows\system32\cmd.exe
                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                                  2⤵
                                    PID:1492
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                                    2⤵
                                      PID:1820
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist.exe /SVC
                                        3⤵
                                        • Enumerates processes with tasklist
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1456
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                                      2⤵
                                        PID:1012
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                                        2⤵
                                          PID:820
                                          • C:\Windows\system32\driverquery.exe
                                            driverquery.exe
                                            3⤵
                                              PID:948
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                                            2⤵
                                              PID:436
                                            • C:\Windows\system32\cmd.exe
                                              cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                                              2⤵
                                                PID:908
                                                • C:\Windows\system32\reg.exe
                                                  reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                                  3⤵
                                                    PID:1532
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                                                  2⤵
                                                    PID:864
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\229C.bin1 > C:\Users\Admin\AppData\Local\Temp\229C.bin & del C:\Users\Admin\AppData\Local\Temp\229C.bin1"
                                                    2⤵
                                                      PID:672
                                                    • C:\Windows\system32\makecab.exe
                                                      makecab.exe /F "C:\Users\Admin\AppData\Local\Temp\BF76.bin"
                                                      2⤵
                                                        PID:436
                                                    • C:\Windows\system32\taskeng.exe
                                                      taskeng.exe {8FCC81F6-B829-4283-BFC3-51ACE45A0EDD} S-1-5-21-1131729243-447456001-3632642222-1000:AVGLFESB\Admin:Interactive:[1]
                                                      1⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1976
                                                      • C:\Users\Admin\AppData\Roaming\htgjdbf
                                                        C:\Users\Admin\AppData\Roaming\htgjdbf
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2044
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 124
                                                          3⤵
                                                          • Loads dropped DLL
                                                          • Program crash
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:992
                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                      1⤵
                                                      • Modifies Internet Explorer settings
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SetWindowsHookEx
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:668
                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:668 CREDAT:275457 /prefetch:2
                                                        2⤵
                                                        • Modifies Internet Explorer settings
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1620
                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:668 CREDAT:537608 /prefetch:2
                                                        2⤵
                                                        • Modifies Internet Explorer settings
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1240

                                                    Network

                                                    MITRE ATT&CK Enterprise v6

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • memory/240-1-0x0000000000EF0000-0x0000000000F01000-memory.dmp

                                                      Filesize

                                                      68KB

                                                      Download

                                                    • memory/240-0-0x0000000000E0A000-0x0000000000E0B000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/316-64-0x00000000004F0000-0x000000000058A000-memory.dmp

                                                      Filesize

                                                      616KB

                                                      Download

                                                    • memory/992-17-0x0000000001FD0000-0x0000000001FE1000-memory.dmp

                                                      Filesize

                                                      68KB

                                                      Download

                                                    • memory/992-15-0x0000000001FD0000-0x0000000001FE1000-memory.dmp

                                                      Filesize

                                                      68KB

                                                      Download

                                                    • memory/992-23-0x0000000002660000-0x0000000002671000-memory.dmp

                                                      Filesize

                                                      68KB

                                                      Download

                                                    • memory/1208-61-0x0000000008130000-0x00000000081CA000-memory.dmp

                                                      Filesize

                                                      616KB

                                                      Download

                                                    • memory/1208-60-0x0000000007E30000-0x0000000007ECA000-memory.dmp

                                                      Filesize

                                                      616KB

                                                      Download

                                                    • memory/1208-79-0x0000000006910000-0x000000000699F000-memory.dmp

                                                      Filesize

                                                      572KB

                                                      Download

                                                    • memory/1208-3-0x0000000002E80000-0x0000000002E96000-memory.dmp

                                                      Filesize

                                                      88KB

                                                      Download

                                                    • memory/1368-37-0x0000000002760000-0x0000000002761000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/1368-39-0x000000001C230000-0x000000001C231000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/1368-34-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

                                                      Filesize

                                                      9.9MB

                                                      Download

                                                    • memory/1368-35-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/1368-36-0x000000001AC50000-0x000000001AC51000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/1368-40-0x000000001C3E0000-0x000000001C3E1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/1368-48-0x00000000026D0000-0x00000000026D1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/1368-38-0x0000000001F30000-0x0000000001F31000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/1368-56-0x00000000027A0000-0x00000000027A1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/1368-58-0x000000001C2C0000-0x000000001C35A000-memory.dmp

                                                      Filesize

                                                      616KB

                                                      Download

                                                    • memory/1620-31-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/1688-25-0x000007FEF7AF0000-0x000007FEF7D6A000-memory.dmp

                                                      Filesize

                                                      2.5MB

                                                      Download

                                                    • memory/2004-7-0x0000000000FF0000-0x0000000001001000-memory.dmp

                                                      Filesize

                                                      68KB

                                                      Download

                                                    • memory/2004-6-0x0000000000D6A000-0x0000000000D6B000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/2044-11-0x0000000000D5A000-0x0000000000D5B000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/2044-12-0x0000000001020000-0x0000000001031000-memory.dmp

                                                      Filesize

                                                      68KB

                                                      Download