gozi_rm3 | 8162e0799dc6887d63119af7836399684041e981d8e1cc48d0bf852dc785d8ce

General

Target

book-AUY70-04022021.xls
Size

139KB
MD5

6bc6146cc33968b9b1f1ea29a65f28aa
SHA1

e681ce7f9b6a16c9926817c18365ba3610366da4
SHA256

8162e0799dc6887d63119af7836399684041e981d8e1cc48d0bf852dc785d8ce
SHA512

0e8fe206306c1fa2f5f27a9df172d8c8f6667eb67cb2ac58a0e9d2c928ba3725d1d3c857449a66b1f1f6154a8240a4234b95a61fd451a17c41dbe077874f5fa1

Score

10^/10

gozi_rm3 201193207 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Botnet

201193207

C2

https://topitophug.xyz

Attributes

build
300932
exe_type
loader

rsa_pubkey.base64

serpent.plain

Signatures

Gozi RM3
A heavily modified version of Gozi using RM3 loader.
banker trojan gozi_rm3

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4028	540	rundll32.exe	EXCEL.EXE

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

52 3936 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3936 rundll32.exe

flow	pid	process
52	3936	rundll32.exe

pid	process
3936	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 78 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e10f76d0fbd601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B281D763-67C3-11EB-B59A-F6A5F321BADB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1015916883"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "319302428"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67335197-67C3-11EB-B59A-F6A5F321BADB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30866384"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0578e6ed0fbd601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30866384"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB2FDF06-67C3-11EB-B59A-F6A5F321BADB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4380fda358018498ae595f5cbca0d3300000000020000000000106600000001000020000000e0968e833d2214d397e5bd3a02f92b0adf5fca409b967330bf559805c9bb535d000000000e800000000200002000000035102c6d688635e99033501334bb83a54eae59400e38bc8fc2b0988747c5ca68200000002adbbbe00fa1eea113320666dd69bf77b5b656ecd47d74f56f97b18394e9c3d540000000ea92d14cc9ea8760774dcb9b74d4ef33ec740d6623b8d4aa912a7382d28b970e29d948ab97c9d25c881e8240602dfc77c4790b78d0ebc947be2091db6d72a970	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4380fda358018498ae595f5cbca0d330000000002000000000010660000000100002000000049acdae1af0aeb392c65885c56711c1e118b7574b5e7b67948629ba80e2b35c9000000000e800000000200002000000018ca6c4eaa69018851c1ae728ee4ffc7345f622c7a48a319820afad0a4906683200000005c51c09d007a7222130662c4d6670a89ff3aa732507f9cd800a3d1b560b1ab5c40000000e20def7a5846b030d17682a1a748504b193f2d3789a7615feff3a493248c54ee509ef6a2bad7e07ff9b7e692c63ade4b89cf59980ff981fc8e15a0907686c3c1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1022086cd0fbd601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30866384"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4380fda358018498ae595f5cbca0d33000000000200000000001066000000010000200000000425cded5dd6a3b9fa2004bf180584fa5878168f5eba6597b3fbe5ab3042ef86000000000e8000000002000020000000916bde984ae024125711d60bf97ba3461286aca894ee8efa9bb45548520511a020000000a03babd4ef8040cc42c6b394b79b6df73624fdced4f67999d33c5a72ff98887e400000006bad6a227ede19910ef60d85fe1037e286c152fe93936b88a2d76acfc04a2b05605bede96fbc60f11b1e547a8df01214836c9bf024106b6e7962e67aab1a4627	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d4380fda358018498ae595f5cbca0d330000000002000000000010660000000100002000000045423794cd0b57933d59a9a95cce773562eb668be0d801a0cc4634327f2ac6d3000000000e80000000020000200000006d21ed526d7dd5e367657affddce03fa819b4c9fda82938f883ebfa8f2b5bd8b20000000c61d1c81bd4b5efdd68ce92f619b469c2e8d3ad04f6ef13f3844fffb06dc531e40000000695f79e370a93ce53d049473f12e2e6dac827bf5c50dd65433b10d32a04ffa6173220b92a002b99e774064dc79466f529e4e0c845037cb79061ebae5e57505a0	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

540 EXCEL.EXE
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exe

pid process

500 iexplore.exe
1172 iexplore.exe
3768 iexplore.exe

pid	process
500	iexplore.exe
1172	iexplore.exe
3768	iexplore.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

EXCEL.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
540	EXCEL.EXE
540	EXCEL.EXE
540	EXCEL.EXE
540	EXCEL.EXE
540	EXCEL.EXE
540	EXCEL.EXE
540	EXCEL.EXE
540	EXCEL.EXE
500	iexplore.exe
500	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
540	EXCEL.EXE
540	EXCEL.EXE
540	EXCEL.EXE
540	EXCEL.EXE
1172	iexplore.exe
1172	iexplore.exe
3700	IEXPLORE.EXE
3700	IEXPLORE.EXE
3768	iexplore.exe
3768	iexplore.exe
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

EXCEL.EXErundll32.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 540 wrote to memory of 4028	540	EXCEL.EXE	rundll32.exe
PID 540 wrote to memory of 4028	540	EXCEL.EXE	rundll32.exe
PID 4028 wrote to memory of 3936	4028	rundll32.exe	rundll32.exe
PID 4028 wrote to memory of 3936	4028	rundll32.exe	rundll32.exe
PID 4028 wrote to memory of 3936	4028	rundll32.exe	rundll32.exe
PID 500 wrote to memory of 2104	500	iexplore.exe	IEXPLORE.EXE
PID 500 wrote to memory of 2104	500	iexplore.exe	IEXPLORE.EXE
PID 500 wrote to memory of 2104	500	iexplore.exe	IEXPLORE.EXE
PID 1172 wrote to memory of 3700	1172	iexplore.exe	IEXPLORE.EXE
PID 1172 wrote to memory of 3700	1172	iexplore.exe	IEXPLORE.EXE
PID 1172 wrote to memory of 3700	1172	iexplore.exe	IEXPLORE.EXE
PID 3768 wrote to memory of 1528	3768	iexplore.exe	IEXPLORE.EXE
PID 3768 wrote to memory of 1528	3768	iexplore.exe	IEXPLORE.EXE
PID 3768 wrote to memory of 1528	3768	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\book-AUY70-04022021.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SYSTEM32\rundll32.exe
rundll32 C:\nuewi\neiq.auw,DllRegisterServer
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4028

C:\Windows\SysWOW64\rundll32.exe
rundll32 C:\nuewi\neiq.auw,DllRegisterServer
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3936

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:500

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:500 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2104

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3700

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3768 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\61F95D72644321B3AD7A1D512B8D6E8B
MD5
9bc7c66842ce55fb615785434a1e4ae2

SHA1
0841bba8f45cc927201dab1668d7de43c808f3a8

SHA256
cdf81a744d87fcc80a9593edceb9103d9eb19ee8023da16b26c17844ffa88eaa

SHA512
e85136f1da80428111ce2f626f6e90dff88d11f2de62f461d292104f2807b08ae2c625397d6c889544566c15cd772e1ed45b2fa18d89489140d59b6bb7fc9eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4
MD5
0cb6aff7f00ffdce23877e0fd80f88d5

SHA1
7cb46bde95f4e57c108100dff3786dc9d6169389

SHA256
fb6bd4558196dad5d2767534f435159f7ce7d69f8e0bb21d73af02b8778f5ad0

SHA512
04bfc5e5430709750613273778c7fc3a5d9eedc618fc60b6db2a55247c3a30609fbb0758f8923e3a84984ecae4903e68ee165f3c8515b8e922b70dceb9f402b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\61F95D72644321B3AD7A1D512B8D6E8B
MD5
d55e899bd240fe3c7b5d87896f49b65f

SHA1
1875aedaa20c97830318e3242d58daba7bf3be42

SHA256
76d741f3b3f48620573defb00a2efaf359dcdad9bd99d71a4794cc30641bd234

SHA512
dde6404860b128a79aecd939f7e96f2c89a259e7218719d28a46156e7c9059c56a6588691041ac2a1c43ee2b10ee4b974b5e2723104e2fe5f131810788ab19bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4
MD5
f56a4ce0df4021db843d755d084a9caf

SHA1
18f07ebd80ebc3d3e1053309189f720949e8725b

SHA256
a9310ba87526ce98612bf9a1257434ca4bfdb322650a8c8a6b5f7c27858ee19e

SHA512
ce482edf1a79dc0f322662d178e6ce838a1a8ddecc556a4bb785a85dc90e907a7253530159d2434730e2019517b92665725c11b0924d8ac848cdd3a0a59cabcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\YVNESD2A.cookie
MD5
6ce796afe36f43246736b06da032bac3

SHA1
21591bf89e3a4a7ff305a81f0b67dc8f7272fea7

SHA256
c74f486c9be9d56877f8e11fc3378307955dca271393aa86a5bcfb12cc0da37d

SHA512
ec69b9b30f77990fcefc5145721872fb2c88e85e4421d1a83a43d7bacf3b26c71ef76c932b3ff50746a23ed2c32d877f39c4f87d36450ee2bde74ed1f207b751

Download Submit
C:\nuewi\neiq.auw
MD5
d31c0491f522d6b9f2102109bd2420af

SHA1
dc1cccf0e43ec5a68326ae4faf1a8cbc5ac00708

SHA256
f7c79c0c3feb7c0032424f5f6a9bcdf78d1815ee53f807cc192c2c1f8f21270f

SHA512
48d659660654800da4eb3909a06572dfcf5f05ebdfb8629fafdfeab601673e3377d9a3a241f4bd36c3f4f912ac838dbc73926f734bfa8a76ec43fa726b28c3bd

Download Submit
\nuewi\neiq.auw
MD5
d31c0491f522d6b9f2102109bd2420af

SHA1
dc1cccf0e43ec5a68326ae4faf1a8cbc5ac00708

SHA256
f7c79c0c3feb7c0032424f5f6a9bcdf78d1815ee53f807cc192c2c1f8f21270f

SHA512
48d659660654800da4eb3909a06572dfcf5f05ebdfb8629fafdfeab601673e3377d9a3a241f4bd36c3f4f912ac838dbc73926f734bfa8a76ec43fa726b28c3bd

Download Submit
memory/540-6-0x00007FF9A7230000-0x00007FF9A7867000-memory.dmp

Filesize
6.2MB

Download
memory/540-2-0x00007FF983B50000-0x00007FF983B60000-memory.dmp

Filesize
64KB

Download
memory/540-5-0x00007FF983B50000-0x00007FF983B60000-memory.dmp

Filesize
64KB

Download
memory/540-4-0x00007FF983B50000-0x00007FF983B60000-memory.dmp

Filesize
64KB

Download
memory/540-3-0x00007FF983B50000-0x00007FF983B60000-memory.dmp

Filesize
64KB

Download
memory/1528-22-0x0000000000000000-mapping.dmp

Download
memory/2104-15-0x0000000000000000-mapping.dmp

Download
memory/3700-17-0x0000000000000000-mapping.dmp

Download
memory/3936-12-0x00000000045F0000-0x0000000004602000-memory.dmp

Filesize
72KB

Download
memory/3936-14-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

Filesize
64KB

Download
memory/3936-13-0x0000000002E90000-0x0000000002E9E000-memory.dmp

Filesize
56KB

Download
memory/3936-11-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/3936-9-0x0000000000000000-mapping.dmp

Download
memory/4028-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads