gozi_rm3 | d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339

General

Target

ursnif_23032021.dll
Size

60KB
MD5

fd52ace064492971c79ae679d1326aef
SHA1

b8fb62eaf0415586a1949863c1981d543199179b
SHA256

d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339
SHA512

1249c6d8f72e45631d47bf27489761963bd2148e0c0ec1743973bbf386268cd2a9be65bc8fa6d1d9a38ada8b35e8e78f6f02a0780af12d50c461ddeec12ca10b

Score

10^/10

gozi_rm3 210307 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

exe_type
loader

Extracted

Family

gozi_rm3

Botnet

210307

C2

https://thetopdomain.xyz

Attributes

build
300960
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Signatures

Gozi RM3
A heavily modified version of Gozi using RM3 loader.
banker trojan gozi_rm3

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03d90c16f38d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000f1a152cb425aabb9b8f019cd719466ccd8a083620e81f03ec4ab1716692da21e000000000e80000000020000200000000c3f00d97a50377db578e00aac85e949c639b1d774b010cd5574758037c56e6020000000328eac09c54d566fdb57b5137d46292f2410d1d8c39f8c6c4fca05a828b7cb1e40000000003a76bff9e3f956586e3ec2c78f086e6bfe0deb92f5d6cd4ae69bf2b2a84c44c1f0d5cc278b2a04b12a63f676f98361971da3233bb5e09416f08f46e95cd915	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000f703f38c6a3b2156bf1d3d621fcc6efbd074bb2d951fbe98a8e11393647aecc0000000000e8000000002000020000000a1d16810d6acb88713ded64e8d2dc5f41e4f46addd0451b0211f5522f980a5472000000072fd074d3a29e86380fb46e7d03f0b9b708e57b8daa2c3bb82d65e1f184e126e400000009057fa52a2b1e8679faaaaa406dbb564fe0ce8aa3cccca8eccad75395c3e098085ed727fac4381719bbeb486dc547a28a23cb1538c41bf9758d19d8e6b1aa846	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2392770393"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05815D9C-A463-11EB-B2DB-EE0798CE3A7D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000eae08219e2bde59c4bbdd0eadbdbeb03544198ec00183818b72edbfc3ec64c7d000000000e800000000200002000000090435ce24a0505c1046b72e303ca8a82d740f6a5f912b5ba651d7b2dd0b7b12920000000eed492f6145cb7373094ecc696c15e433ad3c37fa9d85115c7988fe31761c2e2400000005c363771fe4d672ab0d5dc6136bdf1c66c401fbbe2b93246901deddf43554b1a3b4377f78eb91a1b80196aeaff98c015aa6427858adcb9961f0415b531f4b1b3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305526926f38d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6099d0b96f38d701	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6473892-A462-11EB-B2DB-EE0798CE3A7D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F419BEF-A463-11EB-B2DB-EE0798CE3A7D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000831966f38d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a7599e6f38d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA51E5A2-A462-11EB-B2DB-EE0798CE3A7D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E294AB2C-A462-11EB-B2DB-EE0798CE3A7D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2392770393"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000ff383749b56d8de05aa78ffce67ebd7fb3678d35ed7a8d74b9d0c2d913062182000000000e8000000002000020000000f342f62c9b1ac434c5af4be8d1b834fcb9cf58716c583f87a530cd52318de5d420000000e2da6fea85f0d27afd863b452660eeb18c5157a9b70ab3bb8bc204a06de435574000000051f6f77f8ee4894ee6edcbe6cbe05abebd5796748b7351a65de780da541cf3d355ce121482034d333d93ec2eb15b1c8fb359f70d78ef72cea364b89de7c98642	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

204 iexplore.exe
2276 iexplore.exe
2272 iexplore.exe
2264 iexplore.exe
3948 iexplore.exe
1040 iexplore.exe
936 iexplore.exe
3380 iexplore.exe

Suspicious use of SetWindowsHookEx 32 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
204	iexplore.exe
204	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
2276	iexplore.exe
2276	iexplore.exe
1868	IEXPLORE.EXE
1868	IEXPLORE.EXE
2272	iexplore.exe
2272	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2264	iexplore.exe
2264	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
3948	iexplore.exe
3948	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
1040	iexplore.exe
1040	iexplore.exe
4028	IEXPLORE.EXE
4028	IEXPLORE.EXE
936	iexplore.exe
936	iexplore.exe
968	IEXPLORE.EXE
968	IEXPLORE.EXE
3380	iexplore.exe
3380	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

regsvr32.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 764 wrote to memory of 1776	764	regsvr32.exe	regsvr32.exe
PID 764 wrote to memory of 1776	764	regsvr32.exe	regsvr32.exe
PID 764 wrote to memory of 1776	764	regsvr32.exe	regsvr32.exe
PID 204 wrote to memory of 3036	204	iexplore.exe	IEXPLORE.EXE
PID 204 wrote to memory of 3036	204	iexplore.exe	IEXPLORE.EXE
PID 204 wrote to memory of 3036	204	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 1868	2276	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 1868	2276	iexplore.exe	IEXPLORE.EXE
PID 2276 wrote to memory of 1868	2276	iexplore.exe	IEXPLORE.EXE
PID 2272 wrote to memory of 2936	2272	iexplore.exe	IEXPLORE.EXE
PID 2272 wrote to memory of 2936	2272	iexplore.exe	IEXPLORE.EXE
PID 2272 wrote to memory of 2936	2272	iexplore.exe	IEXPLORE.EXE
PID 2264 wrote to memory of 1216	2264	iexplore.exe	IEXPLORE.EXE
PID 2264 wrote to memory of 1216	2264	iexplore.exe	IEXPLORE.EXE
PID 2264 wrote to memory of 1216	2264	iexplore.exe	IEXPLORE.EXE
PID 3948 wrote to memory of 2136	3948	iexplore.exe	IEXPLORE.EXE
PID 3948 wrote to memory of 2136	3948	iexplore.exe	IEXPLORE.EXE
PID 3948 wrote to memory of 2136	3948	iexplore.exe	IEXPLORE.EXE
PID 1040 wrote to memory of 4028	1040	iexplore.exe	IEXPLORE.EXE
PID 1040 wrote to memory of 4028	1040	iexplore.exe	IEXPLORE.EXE
PID 1040 wrote to memory of 4028	1040	iexplore.exe	IEXPLORE.EXE
PID 936 wrote to memory of 968	936	iexplore.exe	IEXPLORE.EXE
PID 936 wrote to memory of 968	936	iexplore.exe	IEXPLORE.EXE
PID 936 wrote to memory of 968	936	iexplore.exe	IEXPLORE.EXE
PID 3380 wrote to memory of 2688	3380	iexplore.exe	IEXPLORE.EXE
PID 3380 wrote to memory of 2688	3380	iexplore.exe	IEXPLORE.EXE
PID 3380 wrote to memory of 2688	3380	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ursnif_23032021.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ursnif_23032021.dll
2⤵
PID:1776

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:204 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:1868

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:2936

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:1216

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3948 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2136

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4028

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:936 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:968

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3380 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4
MD5
d1b1f562e42dd37c408c0a3c7ccfe189

SHA1
c01e61a5c5f44fb038228b7e542f6a8d7c8c283d

SHA256
7f468f04fe5a1b0616685f157a4285090b6ed3858d4cd9efe915aaeed83c158e

SHA512
404d279fabd4886008e47e9138f799cf398f0aa4c8556192d6e45dbcde99eac2cd65c47b9e0b88bd6d3a6529818f6048a23a197a913fb917b19dffbbd5d75850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4
MD5
066630edd3d05079f098db7a5b76b637

SHA1
52c7cf3fe2a9e5c5db48d43c49d035dcdc12dfe8

SHA256
9539be1660033dc59e93ab21fd4cb1b2a9f59bec94a0d49b5e4c44a7bec7afac

SHA512
6ae8ba4e442349d0fcf747c1fecffeb216a0cd48c5c7c83273032ece32a5da8ca2e4ea064a42cb9386240e22cc0ffaa895da1e7dfdf4acf17392124b8acd73a8

Download Submit
memory/204-118-0x00007FF9BC1B0000-0x00007FF9BC21B000-memory.dmp

Filesize
428KB

Download
memory/936-132-0x00007FF9CBBF0000-0x00007FF9CBC5B000-memory.dmp

Filesize
428KB

Download
memory/968-133-0x0000000000000000-mapping.dmp

Download
memory/1040-130-0x00007FF9CBBF0000-0x00007FF9CBC5B000-memory.dmp

Filesize
428KB

Download
memory/1216-127-0x0000000000000000-mapping.dmp

Download
memory/1776-115-0x00000000009E0000-0x00000000009F3000-memory.dmp

Filesize
76KB

Download
memory/1776-114-0x0000000000000000-mapping.dmp

Download
memory/1868-121-0x0000000000000000-mapping.dmp

Download
memory/2136-129-0x0000000000000000-mapping.dmp

Download
memory/2264-126-0x00007FF9CBBF0000-0x00007FF9CBC5B000-memory.dmp

Filesize
428KB

Download
memory/2272-124-0x00007FF9CBBF0000-0x00007FF9CBC5B000-memory.dmp

Filesize
428KB

Download
memory/2276-120-0x00007FF9CBBF0000-0x00007FF9CBC5B000-memory.dmp

Filesize
428KB

Download
memory/2688-135-0x0000000000000000-mapping.dmp

Download
memory/2936-125-0x0000000000000000-mapping.dmp

Download
memory/3036-119-0x0000000000000000-mapping.dmp

Download
memory/3380-134-0x00007FF9CD710000-0x00007FF9CD77B000-memory.dmp

Filesize
428KB

Download
memory/3948-128-0x00007FF9CBBF0000-0x00007FF9CBC5B000-memory.dmp

Filesize
428KB

Download
memory/4028-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads