Analysis
- max time kernel
5s - max time network
150s - platform
windows7_x64 - resource
win7v20210410 - submitted
14/05/2021, 19:16
General
- Target 7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe
- Size 8KB
- Sample210514-2yfvx77ssx
- SHA256 5397b6d592556e4d65cd442190cfbcba5b3d253b0fbfcc0a16f1c6f2b48a58c4
Malware Config
Extracted
-
smokeloader
-
2020
-
http://999080321newfolder1002002131-service1002.space/
-
http://999080321newfolder1002002231-service1002.space/
-
http://999080321newfolder3100231-service1002.space/
-
http://999080321newfolder1002002431-service1002.space/
-
http://999080321newfolder1002002531-service1002.space/
-
http://999080321newfolder33417-012425999080321.space/
-
http://999080321test125831-service10020125999080321.space/
-
http://999080321test136831-service10020125999080321.space/
-
http://999080321test147831-service10020125999080321.space/
-
http://999080321test146831-service10020125999080321.space/
-
http://999080321test134831-service10020125999080321.space/
-
http://999080321est213531-service1002012425999080321.ru/
-
http://999080321yes1t3481-service10020125999080321.ru/
-
http://999080321test13561-service10020125999080321.su/
-
http://999080321test14781-service10020125999080321.info/
-
http://999080321test13461-service10020125999080321.net/
-
http://999080321test15671-service10020125999080321.tech/
-
http://999080321test12671-service10020125999080321.online/
-
http://999080321utest1341-service10020125999080321.ru/
-
http://999080321uest71-service100201dom25999080321.ru/
Extracted
-
gozi_ifsb
-
5151
-
ieonline.microsoft.com
-
config.edge.skype.com
-
nav.smartscreen.microsoft.com
-
pumolenory.xyz
-
rumolenory.xyz
-
build
250196
-
dga_season
10
-
exe_type
loader
-
server_id
12
Signatures
- Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- VMProtect packed file 15 IoCs
Detects executables packed with VMProtect commercial packer.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
- Kills process with taskkill 5 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe"C:\Users\Admin\AppData\Local\Temp\7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vh71BDcYQNaDcPWGma3qKlNO.exe"C:\Users\Admin\AppData\Roaming\vh71BDcYQNaDcPWGma3qKlNO.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "vh71BDcYQNaDcPWGma3qKlNO.exe" /f & erase "C:\Users\Admin\AppData\Roaming\vh71BDcYQNaDcPWGma3qKlNO.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "vh71BDcYQNaDcPWGma3qKlNO.exe" /f4⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Roaming\DXEG6ghG3Vhg657aetFehy2L.exe"C:\Users\Admin\AppData\Roaming\DXEG6ghG3Vhg657aetFehy2L.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\4Th8vrPKGK5tcV7ajuC5pCgN.exe"C:\Users\Admin\AppData\Roaming\4Th8vrPKGK5tcV7ajuC5pCgN.exe"2⤵
-
C:\Program Files (x86)\Company\NewProduct\setup.exe"C:\Program Files (x86)\Company\NewProduct\setup.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Program Files (x86)\Company\NewProduct\setup.exe" & exit4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "setup.exe" /f5⤵
- Kills process with taskkill
-
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 1924⤵
- Program crash
-
-
-
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"3⤵
-
-
C:\Program Files (x86)\Company\NewProduct\customer2.exe"C:\Program Files (x86)\Company\NewProduct\customer2.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
-
C:\Program Files (x86)\Company\NewProduct\wangjun.exe"C:\Program Files (x86)\Company\NewProduct\wangjun.exe"3⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install4⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\Ibb17sNPe3Dd3nwYIPinzGmV.exe"C:\Users\Admin\AppData\Roaming\Ibb17sNPe3Dd3nwYIPinzGmV.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 5283⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Ccn3TeMR7TG0yJgbdMOwhTz6.exe"C:\Users\Admin\AppData\Roaming\Ccn3TeMR7TG0yJgbdMOwhTz6.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Ccn3TeMR7TG0yJgbdMOwhTz6.exe"C:\Users\Admin\AppData\Roaming\Ccn3TeMR7TG0yJgbdMOwhTz6.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\o8hlbQ7iy7QLpxFsmAXV9LBg.exe"C:\Users\Admin\AppData\Roaming\o8hlbQ7iy7QLpxFsmAXV9LBg.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\b4Y1Jv9DBBMHQgJvsSYh8ktU.exe"C:\Users\Admin\AppData\Roaming\b4Y1Jv9DBBMHQgJvsSYh8ktU.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "b4Y1Jv9DBBMHQgJvsSYh8ktU.exe" /f & erase "C:\Users\Admin\AppData\Roaming\b4Y1Jv9DBBMHQgJvsSYh8ktU.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "b4Y1Jv9DBBMHQgJvsSYh8ktU.exe" /f4⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Roaming\gbWhqV61nLn6V6CzEkySJMBV.exe"C:\Users\Admin\AppData\Roaming\gbWhqV61nLn6V6CzEkySJMBV.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\XamH1aH2xUyyCf8uLZPl8gwa.exe"C:\Users\Admin\AppData\Roaming\XamH1aH2xUyyCf8uLZPl8gwa.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Roaming\SUJ1rBFKTtMDf069Q2Pf9Lay.exe"C:\Users\Admin\AppData\Roaming\SUJ1rBFKTtMDf069Q2Pf9Lay.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\SUJ1rBFKTtMDf069Q2Pf9Lay.exe"{path}"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\UKEKN2Pd7BTHHF0w1F16lCNv.exe"C:\Users\Admin\AppData\Roaming\UKEKN2Pd7BTHHF0w1F16lCNv.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\wDLtd1ssijeOlamxkReq6tCK.exe"C:\Users\Admin\AppData\Roaming\wDLtd1ssijeOlamxkReq6tCK.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\gWlMiw1L0EcBEPJf7w4e7Ui7.exe"C:\Users\Admin\AppData\Roaming\gWlMiw1L0EcBEPJf7w4e7Ui7.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\ZznSvMHBzGpSs2qYPV0M14Wx.exe"C:\Users\Admin\AppData\Roaming\ZznSvMHBzGpSs2qYPV0M14Wx.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\MoAUjGnsnqv2CUUOF0V4FCi0.exe"C:\Users\Admin\AppData\Roaming\MoAUjGnsnqv2CUUOF0V4FCi0.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 1923⤵
- Program crash
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe" & exit2⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe" /f3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1492 CREDAT:275457 /prefetch:22⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/296-86-0x000000013FD30000-0x000000013FD31000-memory.dmp
memory/672-79-0x0000000075EF1000-0x0000000075EF3000-memory.dmp
memory/772-61-0x000000001B2C0000-0x000000001B2C2000-memory.dmp
memory/772-59-0x0000000000E00000-0x0000000000E01000-memory.dmp
memory/872-195-0x0000000000C40000-0x0000000000CB0000-memory.dmp
memory/872-194-0x0000000000A40000-0x0000000000A8B000-memory.dmp
memory/948-228-0x0000000000400000-0x0000000000447000-memory.dmp
memory/948-225-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1288-180-0x00000000038C0000-0x00000000038D7000-memory.dmp
memory/1348-117-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/1348-152-0x0000000004B30000-0x0000000004B31000-memory.dmp
memory/1348-223-0x00000000060C0000-0x0000000006182000-memory.dmp
memory/1348-224-0x0000000004B70000-0x0000000004BEC000-memory.dmp
memory/1348-213-0x00000000002D0000-0x00000000002DE000-memory.dmp
memory/1420-146-0x0000000000220000-0x000000000022C000-memory.dmp
memory/1652-219-0x00000000000F0000-0x000000000027A000-memory.dmp
memory/1652-218-0x00000000000F0000-0x00000000000FF000-memory.dmp
memory/1652-220-0x00000000000E0000-0x00000000000E1000-memory.dmp
memory/1660-154-0x0000000000230000-0x000000000025E000-memory.dmp
memory/1660-229-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1712-89-0x0000000000BE0000-0x0000000000BE2000-memory.dmp
memory/1712-125-0x000007FEEC980000-0x000007FEEDA16000-memory.dmp
memory/1744-116-0x0000000000220000-0x000000000024F000-memory.dmp
memory/1744-118-0x0000000000400000-0x000000000047A000-memory.dmp
memory/1828-106-0x0000000001130000-0x0000000001131000-memory.dmp
memory/2080-200-0x0000000000400000-0x0000000000464000-memory.dmp
memory/2080-199-0x0000000000230000-0x0000000000294000-memory.dmp
memory/2108-124-0x0000000000400000-0x000000000060B000-memory.dmp
memory/2156-151-0x00000000001D0000-0x00000000001E0000-memory.dmp
memory/2156-153-0x0000000000280000-0x0000000000292000-memory.dmp
memory/2316-186-0x0000000000250000-0x0000000000251000-memory.dmp
memory/2380-133-0x0000000000400000-0x000000000040C000-memory.dmp
memory/2456-206-0x000007FEFC181000-0x000007FEFC183000-memory.dmp
memory/2456-207-0x00000000004B0000-0x00000000004B1000-memory.dmp
memory/2600-185-0x0000000000460000-0x0000000000461000-memory.dmp
memory/2840-193-0x0000000000860000-0x00000000008BC000-memory.dmp
memory/2840-191-0x0000000010000000-0x0000000010002000-memory.dmp
memory/2840-192-0x0000000001E50000-0x0000000001F51000-memory.dmp
memory/3044-198-0x00000000004F0000-0x0000000000560000-memory.dmp
memory/3044-210-0x00000000027B0000-0x00000000028B6000-memory.dmp