gozi_rm3 | 7bcf94551f01cde9cc82ea6c5b86929eb4ec341adf30af715af2bf0c2ecb6ed4

General

Target

7bcf94551f01cde9cc82ea6c5b86929eb4ec341adf30af715af2bf0c2ecb6ed4.exe
Size

329KB
MD5

b8dfb0c597f151c882146dc2a8ecd086
SHA1

b8f5dcf26989fbfba9703442185b7e6d60739080
SHA256

7bcf94551f01cde9cc82ea6c5b86929eb4ec341adf30af715af2bf0c2ecb6ed4
SHA512

4307a9dc66a4abc82637b8a58cf18acdcba491434aedbf91c283d0c861fa4681b12ce2b60f043eeff8416b80280fc49ba12615ba35bc8630f7c5767db5cef3ad

Score

10^/10

gozi_rm3 202106191 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300974
exe_type
loader

Extracted

Family

gozi_rm3

Botnet

202106191

C2

https://gogorobest.xyz

Attributes

build
300974
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

serpent.plain

Signatures

Gozi RM3
A heavily modified version of Gozi using RM3 loader.
banker trojan gozi_rm3

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa000000000200000000001066000000010000200000008184c82c70e7c515b800918dd676c75c19cf4d1db1519d74bcce929f41c5c49a000000000e8000000002000020000000d073b05201a4af51c1cdf10840a806a2442dcb918cc8bd5bfa6d1d70366b50272000000037a197094f03bf0ec479622331ed535fdf0ab18d7236fa11dcad51f6ad2c637240000000856548219d1943fb18e3b7c6fe6a83965f13a57646bb4f73759d242ef89fe55794bdb37a000f9c46c07fb93f7cd922fba53cff670980cc5bc4a54dc4e993da22	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{417BD447-D4B2-11EB-B2DB-5A4A21AC7400} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa000000000200000000001066000000010000200000005a2b0088df7d04094e51ff1624db0509e735cc1837ba7dc5c6e6ec25a8346b33000000000e800000000200002000000006d72b1d1cd037040f76b86544b23b2faf0adc6b1553f45297953eb5374dd50420000000d9eafb149043825cc8694c798239d859101493e58e7f2085a3db988ba699b0484000000000c1d9367163fdfb0539a9d1a91f49bfdb463d1df9c93e248251e5db35ba6ec7206a9376f769df0f4a2953d109b4fb9f919af5e595af5369fcaea6ff5fefcb07	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00efd6edbe68d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3595133439"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38F8AE83-D4B2-11EB-B2DB-5A4A21AC7400} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000f2e89a2b30a2f501384085edc5dcf71de540f79b15f7b5685d9d735927c6ea04000000000e80000000020000200000000f1b0fc8a94f0fefc10a34e80b012dbde4bae6ff967e882fb88617a196d3d595200000009904db9e95035197125375f073326371a30be88e5557f6981d312b363f0521b740000000ade2bb3159a644031d3bc1428f58d86531d96c2a6725a2a7a2859c9a17851a8f5f5d2060bda308f08d53ff9f629641eeff661cad157644ef90499c749fd724a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01a37ddbe68d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802b3b0ebf68d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa000000000200000000001066000000010000200000009043ce9e0fdd658d727cf237129aa81e5c9f96663e888343832f2aa410d4bc5d000000000e800000000200002000000038c51b57d93ea587ce7095be4653b40354de9bca13a112d51c387bb8890606df200000001476b241dfb6d95e5ce70ab37d61bd469c4ab6b5c51205fc62ce664ca64e90784000000089666307703a84eec8a9f7d43a2800313d630b3c8b350cd54a24ed866c20afd7a0d62c21dab6c04626a00ab522a683a4cdd72189955ea2ca422b67132040d19b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a277fdbe68d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01B28C46-D4B2-11EB-B2DB-5A4A21AC7400} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000fa68e8301bfac0d4c44ee9798d5029ef25ca824da4f1afcc0b971c7b30a97dc1000000000e80000000020000200000007f4e6a4db114c0634e9d86c65eab1a16215ecbe2691e1652237aa9216ad6a73620000000d3a6ea43822d1eb3086c7bc5f1fd5488e7c87a77fe5823c88af1829bd27ca895400000008a0c930ff3b4bdf39ef86ca583e655c01077ff136a440989f1a455299d3c594312abf10f306880df440cea1fbc5530c7c355e3b08f6f013a64da88f2f069d6cc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50495de5be68d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3595133439"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

1972 iexplore.exe
1812 iexplore.exe
2112 iexplore.exe
396 iexplore.exe
1212 iexplore.exe
1732 iexplore.exe
3272 iexplore.exe
1464 iexplore.exe

Suspicious use of SetWindowsHookEx 32 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
1972	iexplore.exe
1972	iexplore.exe
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE
1812	iexplore.exe
1812	iexplore.exe
512	IEXPLORE.EXE
512	IEXPLORE.EXE
2112	iexplore.exe
2112	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
396	iexplore.exe
396	iexplore.exe
3244	IEXPLORE.EXE
3244	IEXPLORE.EXE
1212	iexplore.exe
1212	iexplore.exe
3228	IEXPLORE.EXE
3228	IEXPLORE.EXE
1732	iexplore.exe
1732	iexplore.exe
1508	IEXPLORE.EXE
1508	IEXPLORE.EXE
3272	iexplore.exe
3272	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
1464	iexplore.exe
1464	iexplore.exe
3676	IEXPLORE.EXE
3676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 1972 wrote to memory of 1292	1972	iexplore.exe	IEXPLORE.EXE
PID 1972 wrote to memory of 1292	1972	iexplore.exe	IEXPLORE.EXE
PID 1972 wrote to memory of 1292	1972	iexplore.exe	IEXPLORE.EXE
PID 1812 wrote to memory of 512	1812	iexplore.exe	IEXPLORE.EXE
PID 1812 wrote to memory of 512	1812	iexplore.exe	IEXPLORE.EXE
PID 1812 wrote to memory of 512	1812	iexplore.exe	IEXPLORE.EXE
PID 2112 wrote to memory of 2884	2112	iexplore.exe	IEXPLORE.EXE
PID 2112 wrote to memory of 2884	2112	iexplore.exe	IEXPLORE.EXE
PID 2112 wrote to memory of 2884	2112	iexplore.exe	IEXPLORE.EXE
PID 396 wrote to memory of 3244	396	iexplore.exe	IEXPLORE.EXE
PID 396 wrote to memory of 3244	396	iexplore.exe	IEXPLORE.EXE
PID 396 wrote to memory of 3244	396	iexplore.exe	IEXPLORE.EXE
PID 1212 wrote to memory of 3228	1212	iexplore.exe	IEXPLORE.EXE
PID 1212 wrote to memory of 3228	1212	iexplore.exe	IEXPLORE.EXE
PID 1212 wrote to memory of 3228	1212	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1508	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1508	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1508	1732	iexplore.exe	IEXPLORE.EXE
PID 3272 wrote to memory of 2556	3272	iexplore.exe	IEXPLORE.EXE
PID 3272 wrote to memory of 2556	3272	iexplore.exe	IEXPLORE.EXE
PID 3272 wrote to memory of 2556	3272	iexplore.exe	IEXPLORE.EXE
PID 1464 wrote to memory of 3676	1464	iexplore.exe	IEXPLORE.EXE
PID 1464 wrote to memory of 3676	1464	iexplore.exe	IEXPLORE.EXE
PID 1464 wrote to memory of 3676	1464	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\7bcf94551f01cde9cc82ea6c5b86929eb4ec341adf30af715af2bf0c2ecb6ed4.exe
"C:\Users\Admin\AppData\Local\Temp\7bcf94551f01cde9cc82ea6c5b86929eb4ec341adf30af715af2bf0c2ecb6ed4.exe"
1⤵
PID:656

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1292

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:512

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:396

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:396 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3244

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1212 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:3228

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1508

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3272 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:2556

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
MD5
0675c0d0da9a6eac284a10c2ddda636a

SHA1
6c7856ef6be6b6fce283423cf9d48e7d101d7fa7

SHA256
7852903b2b3bd59c816aa0a74272a4c51bae13f38bb72a67f3fd04b50d061b50

SHA512
09a3f652bd943a7cc3def436c9fe769bf5c30499b78d63598fc2fc23fa15932a08d545354129fc346133efbda456edfe8d4a10bab5a50abe7d132c2228815232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4
MD5
33903bc82111f229f0d3253b54e7dc56

SHA1
3c251b0440960195337ed9608a786a5aa44adea5

SHA256
a5599d4d4c3755410c3f394e1351e788375e8e487b9b4525e2e671ce9a9262c5

SHA512
a374919bb96e04dcd17038ef8638c22602e8969e2b6ace2060beec85dc39781bfcaa1bf31ab54898e1279d05c71d37a78d92c43d3679ce1df890d08799419795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E1A1F5F9038B3A725570AC643199BE3
MD5
1f2bc239e5eaee908952ee78fc85d40a

SHA1
1c6ec44ebf112b4114d88a4cb9481d8256560bcc

SHA256
58cc42d2628227c13950db87d60e23784bcef3e10be7ab198afc854923feee15

SHA512
8b1a1d18693e94a75bf09aa2de7e832ad1caf08eb558897fcfa5ba5c3c5b3111dd027171bfe6f695558ba2ae2e8e13f98d9389dd8282d56b6f6244385e26ba3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD5
2f0ee876ab53bbd4dde2db306b595eb2

SHA1
ad2b8aac4a4fa602bd96e408466d8822a3702d3e

SHA256
9188c3cd0d4d7784b6bb18248973916752120121903b3f9e0c3cfcea09736360

SHA512
44278b5f9cea379e5ca67729deb3cb6819e362890831acd5c1f607357d28118399a5e7633aa9e1b7d27a9675b42b551312cf4c5754d8dea5ef8a1c4851f96626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4
MD5
c64fca51ddf3c611072b7129e5f3f9c7

SHA1
51e584e4656964132be05ce62d64aa7284dd418f

SHA256
5b5e32de2c37572aa862ff920c03e44ae2e2a07d6e4ff6667d93c50a7bcfae3e

SHA512
f4e80aec2ae82ffe261d1a64bb3b09d00ffad860ba69a7872dfa8bb1ea4df63b351615b92bf62300ab64ae17c2f1af1934d1ea521be971eea17648c90f634ea1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E1A1F5F9038B3A725570AC643199BE3
MD5
23d3aed5e2d53b8bc9c2eeeb95d717ca

SHA1
9f9a60a7d1cc31042bcb6618addb6ac80a1c62e0

SHA256
22caec3c3240b061fd5f533cf39464f9120b6483459dad4226a372a760e56256

SHA512
cc764aacb86fc2aa5df1bc262c0cf6b3cf336e9024bc0b96ea457f129b9f0fafa702300bc1fed5580a2ba84bede29b6d96641d8b6c11205307c9eb229195aca8

Download Submit
memory/396-131-0x00007FFA8C4D0000-0x00007FFA8C53B000-memory.dmp

Filesize
428KB

Download
memory/512-122-0x0000000000000000-mapping.dmp

Download
memory/656-118-0x0000000001000000-0x00000000014F0000-memory.dmp

Filesize
4.9MB

Download
memory/656-115-0x0000000000540000-0x0000000000550000-memory.dmp

Filesize
64KB

Download
memory/656-117-0x0000000000520000-0x000000000052C000-memory.dmp

Filesize
48KB

Download
memory/1212-133-0x00007FFA8C4D0000-0x00007FFA8C53B000-memory.dmp

Filesize
428KB

Download
memory/1292-120-0x0000000000000000-mapping.dmp

Download
memory/1464-139-0x00007FFA8C4D0000-0x00007FFA8C53B000-memory.dmp

Filesize
428KB

Download
memory/1508-136-0x0000000000000000-mapping.dmp

Download
memory/1732-135-0x00007FFA8C4D0000-0x00007FFA8C53B000-memory.dmp

Filesize
428KB

Download
memory/1812-121-0x00007FFA8C4D0000-0x00007FFA8C53B000-memory.dmp

Filesize
428KB

Download
memory/1972-119-0x00007FFA7C730000-0x00007FFA7C79B000-memory.dmp

Filesize
428KB

Download
memory/2112-129-0x00007FFA8C4D0000-0x00007FFA8C53B000-memory.dmp

Filesize
428KB

Download
memory/2556-138-0x0000000000000000-mapping.dmp

Download
memory/2884-130-0x0000000000000000-mapping.dmp

Download
memory/3228-134-0x0000000000000000-mapping.dmp

Download
memory/3244-132-0x0000000000000000-mapping.dmp

Download
memory/3272-137-0x00007FFA8C4D0000-0x00007FFA8C53B000-memory.dmp

Filesize
428KB

Download
memory/3676-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads