Analysis

  • max time kernel
    274s
  • max time network
    275s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    21-06-2021 14:40

General

  • Target

    dictate 06.21.doc

  • Size

    49KB

  • MD5

    2778650cf580fcab0d721d41ead80517

  • SHA1

    9464966e79017b77400fd5ea0dd5f1a324cc61bd

  • SHA256

    f2040360f616328b604f250435c203f28ed71cae425e730f1d1106dc4e00b1e1

  • SHA512

    3f7c1d8b96e4d42213c7b9dc756a75b7a1578814933d7975192797e384b55feaeb8bb51241fbfaa25e5111b4f2c6169c056563c1272449cb7b2ed1d8c2909c8e

Malware Config

Extracted

Family

gozi_ifsb

Botnet

6000

C2

authd.feronok.com

app.bighomegl.at

Attributes
  • build

    250204

  • exe_type

    loader

  • server_id

    580

rsa_pubkey.base64
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dictate 06.21.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Windows\SysWOW64\explorer.exe
      explorer c:\programdata\procedureI.hta
      2⤵
      • Process spawned unexpected child process
      PID:1956
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1684
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\procedureI.hta"
        2⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:828
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" c:\users\public\procedureI.jpg
          3⤵
          • Loads dropped DLL
          PID:1748

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\procedureI.hta
      MD5

      35d8c5ca4ad2af5f2a360cad0003bd42

      SHA1

      02ae1065409d7f897a90155f85881f340a847ea1

      SHA256

      471578f00b2f4e3aefc0dc3c625569210c67a08e6ac203de96918c31aa802bb5

      SHA512

      7e7f99739fa74e65ee968b432d7fa80f9cd0cd1bf45064327b88056af70ecd19ae93cf00cc51d5c317a4260931731e164dac6d3331bab263ac995cf61b031d82

    • \??\c:\users\public\procedureI.jpg
      MD5

      17e6579d726d5247808ebe3624794fd5

      SHA1

      90d9554d2532108d472f5843b4361ea3e3732744

      SHA256

      f13c623c28199b87407d7949e5687577cb63f00b92ddb423fd9043da8e107d99

      SHA512

      8139a404fcbe16b74dae50a4124545dc84c3341fcfbb8562abefb4826bf050bc700aa4ff20a36006b5f8508da130f6a2e3280cbb34bdfee1661d66a2fbc39262

    • \Users\Public\procedureI.jpg
      MD5

      17e6579d726d5247808ebe3624794fd5

      SHA1

      90d9554d2532108d472f5843b4361ea3e3732744

      SHA256

      f13c623c28199b87407d7949e5687577cb63f00b92ddb423fd9043da8e107d99

      SHA512

      8139a404fcbe16b74dae50a4124545dc84c3341fcfbb8562abefb4826bf050bc700aa4ff20a36006b5f8508da130f6a2e3280cbb34bdfee1661d66a2fbc39262

    • memory/828-67-0x0000000000000000-mapping.dmp
    • memory/828-70-0x0000000002A80000-0x0000000002A81000-memory.dmp
      Filesize

      4KB

    • memory/1096-60-0x000000006FC31000-0x000000006FC33000-memory.dmp
      Filesize

      8KB

    • memory/1096-59-0x00000000721B1000-0x00000000721B4000-memory.dmp
      Filesize

      12KB

    • memory/1096-61-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1096-78-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1684-68-0x0000000000000000-mapping.dmp
    • memory/1748-71-0x0000000000000000-mapping.dmp
    • memory/1748-75-0x0000000067540000-0x000000006754D000-memory.dmp
      Filesize

      52KB

    • memory/1748-76-0x0000000067540000-0x000000006762A000-memory.dmp
      Filesize

      936KB

    • memory/1748-77-0x0000000000130000-0x0000000000131000-memory.dmp
      Filesize

      4KB

    • memory/1752-65-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp
      Filesize

      8KB

    • memory/1956-62-0x0000000000000000-mapping.dmp
    • memory/1956-64-0x000000006ABB1000-0x000000006ABB3000-memory.dmp
      Filesize

      8KB

    • memory/1956-63-0x0000000075281000-0x0000000075283000-memory.dmp
      Filesize

      8KB