gozi_rm3 | e0f81b847c0c02e0352607f852bdfb651925c35655ebf0be9b4fd2ef034661f3

Resubmissions

12-09-2021 05:03

210912-fp66fsehgn 10

10-09-2021 08:18

210910-j7bdaacghm 10

Analysis

max time kernel
150s
max time network
162s
platform
windows10_x64
resource
win10v20210408
submitted
10-09-2021 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PiSUfsy.exe
Size

880KB
MD5

ddb8cc4e8e2ec81904a1407409d2e868
SHA1

5f594f30bcf6b00213916e5aa987db98d764fbb2
SHA256

e0f81b847c0c02e0352607f852bdfb651925c35655ebf0be9b4fd2ef034661f3
SHA512

70e1ff1b5aa7a5ff7408f4520adece23fbb9df4f3ac9d5aded9baad30fe485c47a2f8cce6b2d500ab6705a18ce20f90c193092c4f943053c67c1cff8b51a5738

Score

10^/10

gozi_rm3 202108021 banker trojan

Malware Config

Extracted

Family

gozi_rm3

Attributes

build
300981

Extracted

Family

gozi_rm3

Botnet

202108021

https://haverit.xyz

Attributes

build
300981
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm

rsa_pubkey.plain

aes.plain

Signatures

Gozi RM3
A heavily modified version of Gozi using RM3 loader.
banker trojan gozi_rm3

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000746b3c591e560c44bd15ec10ece4f6c70000000002000000000010660000000100002000000060dbc5988f71d086fd5ffc38a8022c3bc24b82d61af8179dae6df21e3c5c2d14000000000e800000000200002000000079fe33d9bbadc1e3240fe4c207fc2526944ca930256e0555ca7e3c3002496d4320000000346c7bcf5beed157209ead1b0b341998c1ea9ad03ffe13eabb89ee177db992854000000004a143ded9d2000eb460b4ae448f486fb9c84946e355750332821380cc9fb70a8a0b63a3b2823595fd292a4d098ebca44cc703e983a835bdce56bf0337ef532f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000746b3c591e560c44bd15ec10ece4f6c700000000020000000000106600000001000020000000c0fdc90afd4ac9526118deb093ae2f3316027e80864ef19940a8d873c6a2f44e000000000e8000000002000020000000984699d9c99992e194942c5ae4d81bdbaee9c5923d636ad0b2d402f690faf2262000000083edb635d93e6da017ec7d267bb469a31db08cb3e4c69e273e30103081fbbd62400000005797ae8583e3bcc6b4a3845d6749b46fe8c3ce214e23a2d517e7f826b2ef7190a0c5c596b251807c67f994452c8accba719e9baa78445fa2843b6ab8ba047e13	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BD822C5-1221-11EC-B2DB-F634F559A0EA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36ED4A8B-1221-11EC-B2DB-F634F559A0EA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DE4A91E-1221-11EC-B2DB-F634F559A0EA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1005cbf92da6d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000746b3c591e560c44bd15ec10ece4f6c70000000002000000000010660000000100002000000087e5fafc6b14f5bb31b54d722d358c98b68995f2ac414561cb0c5bf10770c225000000000e800000000200002000000035ff480ca080c63948234405ec0a3092f3ef0a61cd1a69897c22540e109b2d5f200000006b18a490ac49f74c872ceac893b3e031c90c9c1fdd3f5cce7ce67f505a3c4ac3400000004e624a335b58f8b9a1425ed9da5ae98bbc948a9667d7b1a071ed01bcbfa93d4a22d18bc215fbe3c5e16733dd0cfa31ca2cc8ee299977bc543ab5830daeba2e86	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FEEC4FD-1221-11EC-B2DB-F634F559A0EA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000746b3c591e560c44bd15ec10ece4f6c700000000020000000000106600000001000020000000008b6c6382c949037605981902276db764f30d3b026b45f6520deaf3a56c8b5b000000000e8000000002000020000000e130e4730bd62ddec77bb695588ea6ad860123d748a4f88fd141fd337084ccaf20000000802d01bc48fdeb1091d530a9d82d4102c982686e9b0bd4b1fb802561346a7de8400000009e80af07838248537d758283b7241a8e7b19111d0bd3a7c058c8b89b7b9c67c0d22affdc7ca924c1bbfcd8837d4a1fdbd9c2b7cc6d8d0ba72bea28adaade2bee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DCCBA1F-1221-11EC-B2DB-F634F559A0EA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6037ce002ea6d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301bd5eb2da6d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28EB7945-1221-11EC-B2DB-F634F559A0EA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000746b3c591e560c44bd15ec10ece4f6c700000000020000000000106600000001000020000000a556a05f690dad40e22b78185d25faf642fcf3a39a34f4b3427f146d7aa48b1e000000000e80000000020000200000002bce5abcb420d3435c99ce698a5ba2cbb91238f9f128d2b8a3a676e3238b671520000000038c2fc91048776d0ef65087f9d54fe62b115e85a75eb55d11883a519fe38d5640000000b3431df24a2e5eb5c42d8399fd35d77238ce410b5715b80cf9fb4cdcecfbb5f1c5066ef1b5a0ee4c4353395f48cdd97b86f086854f1ec570cc795ff480a0466a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6016bbd02da6d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3442082606"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000746b3c591e560c44bd15ec10ece4f6c700000000020000000000106600000001000020000000974217450bcbde862313fd07440cac9875c93901f96d7487c0d35d57a7c423ea000000000e80000000020000200000005b897388805d0ec6648b7a15d5643334e4062023b576d9629e831d9f4e2f0ae220000000c5586c128299c2aa738bde390d3a4fdafcc653b89a55deb359aab15d6192824540000000c6f511de77cff2c78cf85f768c70fcabb5d9059e3a4265339c59d9abdbfb0c0db7b9c8ab33c1cf0ff5a31dc45a6624067871981e051b3c0ff9b7499a4a481cd0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2300	iexplore.exe
2776	iexplore.exe
3968	iexplore.exe
2136	iexplore.exe
1480	iexplore.exe
3420	iexplore.exe
2172	iexplore.exe
4080	iexplore.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
1548	IEXPLORE.EXE
1548	IEXPLORE.EXE
2776	iexplore.exe
2776	iexplore.exe
964	IEXPLORE.EXE
964	IEXPLORE.EXE
3968	iexplore.exe
3968	iexplore.exe
4084	IEXPLORE.EXE
4084	IEXPLORE.EXE
2136	iexplore.exe
2136	iexplore.exe
1520	IEXPLORE.EXE
1520	IEXPLORE.EXE
1480	iexplore.exe
1480	iexplore.exe
348	IEXPLORE.EXE
348	IEXPLORE.EXE
3420	iexplore.exe
3420	iexplore.exe
508	IEXPLORE.EXE
508	IEXPLORE.EXE
2172	iexplore.exe
2172	iexplore.exe
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
4080	iexplore.exe
4080	iexplore.exe
3952	IEXPLORE.EXE
3952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1548	2300	iexplore.exe	81
PID 2300 wrote to memory of 1548	2300	iexplore.exe	81
PID 2300 wrote to memory of 1548	2300	iexplore.exe	81
PID 2776 wrote to memory of 964	2776	iexplore.exe	83
PID 2776 wrote to memory of 964	2776	iexplore.exe	83
PID 2776 wrote to memory of 964	2776	iexplore.exe	83
PID 3968 wrote to memory of 4084	3968	iexplore.exe	85
PID 3968 wrote to memory of 4084	3968	iexplore.exe	85
PID 3968 wrote to memory of 4084	3968	iexplore.exe	85
PID 2136 wrote to memory of 1520	2136	iexplore.exe	87
PID 2136 wrote to memory of 1520	2136	iexplore.exe	87
PID 2136 wrote to memory of 1520	2136	iexplore.exe	87
PID 1480 wrote to memory of 348	1480	iexplore.exe	89
PID 1480 wrote to memory of 348	1480	iexplore.exe	89
PID 1480 wrote to memory of 348	1480	iexplore.exe	89
PID 3420 wrote to memory of 508	3420	iexplore.exe	91
PID 3420 wrote to memory of 508	3420	iexplore.exe	91
PID 3420 wrote to memory of 508	3420	iexplore.exe	91
PID 2172 wrote to memory of 1312	2172	iexplore.exe	93
PID 2172 wrote to memory of 1312	2172	iexplore.exe	93
PID 2172 wrote to memory of 1312	2172	iexplore.exe	93
PID 4080 wrote to memory of 3952	4080	iexplore.exe	95
PID 4080 wrote to memory of 3952	4080	iexplore.exe	95
PID 4080 wrote to memory of 3952	4080	iexplore.exe	95

C:\Users\Admin\AppData\Local\Temp\PiSUfsy.exe
"C:\Users\Admin\AppData\Local\Temp\PiSUfsy.exe"
1⤵
PID:3128

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1548

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:82945 /prefetch:2
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3968 CREDAT:82945 /prefetch:2
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4084

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:82945 /prefetch:2
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1520

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:82945 /prefetch:2
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:348

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3420 CREDAT:82945 /prefetch:2
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:508

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:82945 /prefetch:2
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1312

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4080 CREDAT:82945 /prefetch:2
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-128-0x00007FFAA45E0000-0x00007FFAA464B000-memory.dmp

Filesize
428KB

Download
memory/2136-126-0x00007FFAA45E0000-0x00007FFAA464B000-memory.dmp

Filesize
428KB

Download
memory/2172-132-0x00007FFAA45E0000-0x00007FFAA464B000-memory.dmp

Filesize
428KB

Download
memory/2300-120-0x00007FFAA2F80000-0x00007FFAA2FEB000-memory.dmp

Filesize
428KB

Download
memory/2776-122-0x00007FFAA2F80000-0x00007FFAA2FEB000-memory.dmp

Filesize
428KB

Download
memory/3128-114-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download
memory/3128-119-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3128-116-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/3128-115-0x0000000001000000-0x00000000010F4000-memory.dmp

Filesize
976KB

Download
memory/3420-130-0x00007FFAA45E0000-0x00007FFAA464B000-memory.dmp

Filesize
428KB

Download
memory/3968-124-0x00007FFAA45E0000-0x00007FFAA464B000-memory.dmp

Filesize
428KB

Download
memory/4080-134-0x00007FFAA45E0000-0x00007FFAA464B000-memory.dmp

Filesize
428KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads