gozi_rm3 | d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339

General

Target

d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339.dll
Size

60KB
MD5

fd52ace064492971c79ae679d1326aef
SHA1

b8fb62eaf0415586a1949863c1981d543199179b
SHA256

d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339
SHA512

1249c6d8f72e45631d47bf27489761963bd2148e0c0ec1743973bbf386268cd2a9be65bc8fa6d1d9a38ada8b35e8e78f6f02a0780af12d50c461ddeec12ca10b

Score

10^/10

gozi_rm3 210307 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

exe_type
loader

Extracted

Family

gozi_rm3

Botnet

210307

C2

https://thetopdomain.xyz

Attributes

build
300960
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Signatures

Gozi RM3
A heavily modified version of Gozi using RM3 loader.
banker trojan gozi_rm3

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB542D15-E5FB-11EB-B2DB-6AC8DF09D482} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD0F9A71-E5FB-11EB-B2DB-6AC8DF09D482} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e6116f087ad701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000f8721a1eb05b84b9a9e804b4dc67d3a00000000020000000000106600000001000020000000dad187169b3aad1e18d122d516e4a6c94ee03e173c58f2702dcfca2113aa09ab000000000e800000000200002000000011bc165c1750c8909dfb4231999796e696f88ac607a8624df461199494fbc14b20000000a723814a06a7c10fe00fb06d5e8a1c0392838a3802e30dce0020565b94c33bbb40000000a851b1f883c7f47303a7c8a45bc138c1021f989bc8721547e0f76789713dffb5a96b282cf0a4fff8ffbc9090687cb5be3b0445d6be45ffc81aa78d4f42b74463	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000f8721a1eb05b84b9a9e804b4dc67d3a000000000200000000001066000000010000200000002d517841136aadc43938561ea826c635bc8f4ff9be0ea5bc0c100cc9b87027cb000000000e800000000200002000000026c040d738b2a8f5dd4045861a04b38bf5ea25f1089cbe55976f8880f28ef205200000003e7313687a23ca696c4eba1e84bca5aa215d9333990d09b5f826b7ef7ab1eb3c4000000078a08fcf8ac34583b9da44c75342c5e8567949c98865dd7c8fd151f06c59f8c743ef5ae1142440e6cef46fe18f04e5e3d107c9a180af46bf30c83a51cca9cec4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000f8721a1eb05b84b9a9e804b4dc67d3a000000000200000000001066000000010000200000002fe8fc0facd80e313a7fc0efd3bcddb47ad4a6f67c02786e6f095e3ba9f5d241000000000e8000000002000020000000a17fb119c9b883c6b6ca8dff5104da2c5f072f06bc40c986681c03eaf3de92bf200000003a1ae7145a7538b243aedd4058215ae43fd6d574cf94d0c34b977ae7283cddc0400000001537d27689d4ddb5508bc16917d8e5d0480df838ee9d145835cbd14b2141dab8d6bd901700892e820ba78b3603f8a957ad7f17c9fc8bb33a2dde286ba8f64fb8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D64F27FD-E5FB-11EB-B2DB-6AC8DF09D482} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000f8721a1eb05b84b9a9e804b4dc67d3a0000000002000000000010660000000100002000000059ff04120124d341b26c3f890b0f5d73467e03ef467654377f26f9ee15d896cf000000000e8000000002000020000000483576bac2a468a96530f6e7860db607ff0c178839da5f82df030a4644d39534200000007e834b84111381471346ad05d4237d515f8bcca478e16005e17b744be0cc3eed4000000068446e81a1fa548b831875b6ae3f5d0f0945de2ddca92961a859a12f286e3c9a378ef1c5c6287c8d3a9631064f844e1a910fd3db34eeb00665f4d6c9f225d926	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ae0270087ad701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000f8721a1eb05b84b9a9e804b4dc67d3a00000000020000000000106600000001000020000000e811a89fe9c3dc317b661a1c47058070602180522578e470011a0a3a4ab22eca000000000e8000000002000020000000e0a1c22f2bd667241653933d2ae66a3fef7daa1360a1faf1c4972486c2e803a92000000070a5adb44ec32036f794494de062e65bd96f8670b7595fad913e9a5adc49490540000000f2a4bad9845437d05729c9897b168a5f80a9a2ad48681c1180fa5c9a8c8b45aad87414b17bfa86ec2bcd26beff3fe35edf08b6d331835e6415f7c4a008ddf3ed	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1821731765"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30898696"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1821731765"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid	process
192	iexplore.exe
2616	iexplore.exe
364	iexplore.exe
3876	iexplore.exe
1908	iexplore.exe
3116	iexplore.exe
3940	iexplore.exe
2052	iexplore.exe
956	iexplore.exe

Suspicious use of SetWindowsHookEx 36 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
192	iexplore.exe
192	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2616	iexplore.exe
2616	iexplore.exe
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE
364	iexplore.exe
364	iexplore.exe
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3876	iexplore.exe
3876	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
1908	iexplore.exe
1908	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
3116	iexplore.exe
3116	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
3940	iexplore.exe
3940	iexplore.exe
1136	IEXPLORE.EXE
1136	IEXPLORE.EXE
2052	iexplore.exe
2052	iexplore.exe
3460	IEXPLORE.EXE
3460	IEXPLORE.EXE
956	iexplore.exe
956	iexplore.exe
1628	IEXPLORE.EXE
1628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

regsvr32.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 652 wrote to memory of 3408	652	regsvr32.exe	regsvr32.exe
PID 652 wrote to memory of 3408	652	regsvr32.exe	regsvr32.exe
PID 652 wrote to memory of 3408	652	regsvr32.exe	regsvr32.exe
PID 192 wrote to memory of 2236	192	iexplore.exe	IEXPLORE.EXE
PID 192 wrote to memory of 2236	192	iexplore.exe	IEXPLORE.EXE
PID 192 wrote to memory of 2236	192	iexplore.exe	IEXPLORE.EXE
PID 2616 wrote to memory of 1512	2616	iexplore.exe	IEXPLORE.EXE
PID 2616 wrote to memory of 1512	2616	iexplore.exe	IEXPLORE.EXE
PID 2616 wrote to memory of 1512	2616	iexplore.exe	IEXPLORE.EXE
PID 364 wrote to memory of 3872	364	iexplore.exe	IEXPLORE.EXE
PID 364 wrote to memory of 3872	364	iexplore.exe	IEXPLORE.EXE
PID 364 wrote to memory of 3872	364	iexplore.exe	IEXPLORE.EXE
PID 3876 wrote to memory of 2524	3876	iexplore.exe	IEXPLORE.EXE
PID 3876 wrote to memory of 2524	3876	iexplore.exe	IEXPLORE.EXE
PID 3876 wrote to memory of 2524	3876	iexplore.exe	IEXPLORE.EXE
PID 1908 wrote to memory of 2796	1908	iexplore.exe	IEXPLORE.EXE
PID 1908 wrote to memory of 2796	1908	iexplore.exe	IEXPLORE.EXE
PID 1908 wrote to memory of 2796	1908	iexplore.exe	IEXPLORE.EXE
PID 3116 wrote to memory of 2240	3116	iexplore.exe	IEXPLORE.EXE
PID 3116 wrote to memory of 2240	3116	iexplore.exe	IEXPLORE.EXE
PID 3116 wrote to memory of 2240	3116	iexplore.exe	IEXPLORE.EXE
PID 3940 wrote to memory of 1136	3940	iexplore.exe	IEXPLORE.EXE
PID 3940 wrote to memory of 1136	3940	iexplore.exe	IEXPLORE.EXE
PID 3940 wrote to memory of 1136	3940	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 3460	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 3460	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 3460	2052	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 1628	956	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 1628	956	iexplore.exe	IEXPLORE.EXE
PID 956 wrote to memory of 1628	956	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\d160a82b9eb5124d9a5da6ded92f40635464cbcdf357feb471a7e87fc56a8339.dll
2⤵
PID:3408

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:192

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:192 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:2236

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:1512

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:364 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:3872

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3876 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2524

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2796

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3116 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3940 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1136

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:82945 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:3460

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/192-118-0x00007FFDD8020000-0x00007FFDD808B000-memory.dmp

Filesize
428KB

Download
memory/364-122-0x00007FFDE7D60000-0x00007FFDE7DCB000-memory.dmp

Filesize
428KB

Download
memory/956-134-0x00007FFDECD90000-0x00007FFDECDFB000-memory.dmp

Filesize
428KB

Download
memory/1136-131-0x0000000000000000-mapping.dmp

Download
memory/1512-121-0x0000000000000000-mapping.dmp

Download
memory/1628-135-0x0000000000000000-mapping.dmp

Download
memory/1908-126-0x00007FFDE7D60000-0x00007FFDE7DCB000-memory.dmp

Filesize
428KB

Download
memory/2052-132-0x00007FFDE7D60000-0x00007FFDE7DCB000-memory.dmp

Filesize
428KB

Download
memory/2236-119-0x0000000000000000-mapping.dmp

Download
memory/2240-129-0x0000000000000000-mapping.dmp

Download
memory/2524-125-0x0000000000000000-mapping.dmp

Download
memory/2616-120-0x00007FFDE7D60000-0x00007FFDE7DCB000-memory.dmp

Filesize
428KB

Download
memory/2796-127-0x0000000000000000-mapping.dmp

Download
memory/3116-128-0x00007FFDE7D60000-0x00007FFDE7DCB000-memory.dmp

Filesize
428KB

Download
memory/3408-115-0x0000000000130000-0x0000000000143000-memory.dmp

Filesize
76KB

Download
memory/3408-114-0x0000000000000000-mapping.dmp

Download
memory/3460-133-0x0000000000000000-mapping.dmp

Download
memory/3872-123-0x0000000000000000-mapping.dmp

Download
memory/3876-124-0x00007FFDE7D60000-0x00007FFDE7DCB000-memory.dmp

Filesize
428KB

Download
memory/3940-130-0x00007FFDE7D60000-0x00007FFDE7DCB000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads