Analysis
- max time kernel
119s - max time network
119s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
24/11/2021, 17:17
General
- Target 7bd0607e809bbed2f1294a4bf3e91fe4.exe
- Size 404KB
- Sample211124-vtpjjadccr
- SHA256 faef6881477bcddcdc4ef70525e388445bb385c558ee5ed08447488527be0de8
Malware Config
Extracted
-
redline
-
udptest
-
193.56.146.64:65441
Extracted
-
gozi_ifsb
-
4483
-
yahoo.com
-
doreuneruy.store
-
qorunegolu.club
-
https://doreuneruy.store
-
https://qorunegolu.club
-
build
250211
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
Signatures
- Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bd0607e809bbed2f1294a4bf3e91fe4.exe"C:\Users\Admin\AppData\Local\Temp\7bd0607e809bbed2f1294a4bf3e91fe4.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mypcs.exe"C:\Users\Admin\AppData\Local\Temp\mypcs.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1520-59-0x00000000063E1000-0x00000000063E2000-memory.dmp
memory/1520-55-0x000000000212B000-0x0000000002157000-memory.dmp
memory/1520-61-0x00000000063E3000-0x00000000063E4000-memory.dmp
memory/1520-60-0x00000000063E2000-0x00000000063E3000-memory.dmp
memory/1520-62-0x0000000003C50000-0x0000000003C7C000-memory.dmp
memory/1520-63-0x00000000063E4000-0x00000000063E6000-memory.dmp
memory/1520-58-0x0000000003AE0000-0x0000000003B0E000-memory.dmp
memory/1520-57-0x0000000000400000-0x0000000001FEA000-memory.dmp
memory/1520-56-0x0000000000220000-0x0000000000259000-memory.dmp
memory/1972-68-0x00000000001B0000-0x00000000001BB000-memory.dmp
memory/1972-69-0x0000000000240000-0x000000000024C000-memory.dmp
memory/1972-70-0x0000000000400000-0x000000000042F000-memory.dmp