Analysis

  • max time kernel
    176s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    07/02/2022, 19:24

General

  • Target

    9ad6dfda0f3827455a92003ae4d7a413a932d7ff0ec99bf1bf36f8cb9e1e31f7.exe

  • Size

    11.7MB

  • MD5

    15ed53cd58c78fc54122a66f19eb0ff1

  • SHA1

    622e3fec06fa58bb2feeded3408c3d82c089bbc0

  • SHA256

    9ad6dfda0f3827455a92003ae4d7a413a932d7ff0ec99bf1bf36f8cb9e1e31f7

  • SHA512

    3bdbecb2db39a01ea8bee9161ea1ca66de1997c3e2ef6f5658726921946f522a6e833fc66fe6130ed70c7f67314a0577b9f15867c75581a28a27e902c9adf883

Malware Config

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 47 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\MusNotifyIcon.exe
    %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
    1⤵
    • Checks processor information in registry
    PID:64
  • C:\Users\Admin\AppData\Local\Temp\9ad6dfda0f3827455a92003ae4d7a413a932d7ff0ec99bf1bf36f8cb9e1e31f7.exe
    "C:\Users\Admin\AppData\Local\Temp\9ad6dfda0f3827455a92003ae4d7a413a932d7ff0ec99bf1bf36f8cb9e1e31f7.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Users\Admin\AppData\Local\Temp\._cache_9ad6dfda0f3827455a92003ae4d7a413a932d7ff0ec99bf1bf36f8cb9e1e31f7.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_9ad6dfda0f3827455a92003ae4d7a413a932d7ff0ec99bf1bf36f8cb9e1e31f7.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:876
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 876 -s 1012
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        PID:3992
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 876 -s 1012
        3⤵
        • Program crash
        PID:1360
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      PID:1832
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    PID:544
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
      PID:3792
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 436 -p 876 -ip 876
      1⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Suspicious use of WriteProcessMemory
      PID:3640

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/876-139-0x0000020F3D730000-0x0000020F3D732000-memory.dmp

            Filesize

            8KB

          • memory/876-134-0x0000020F21120000-0x0000020F21C20000-memory.dmp

            Filesize

            11.0MB

          • memory/876-137-0x00007FF8071D0000-0x00007FF807C91000-memory.dmp

            Filesize

            10.8MB

          • memory/1832-138-0x0000000002110000-0x0000000002111000-memory.dmp

            Filesize

            4KB

          • memory/2584-131-0x0000000002D30000-0x0000000002D31000-memory.dmp

            Filesize

            4KB

          • memory/3792-140-0x00007FF7E7F90000-0x00007FF7E7FA0000-memory.dmp

            Filesize

            64KB

          • memory/3792-142-0x00007FF7E7F90000-0x00007FF7E7FA0000-memory.dmp

            Filesize

            64KB

          • memory/3792-141-0x00007FF7E7F90000-0x00007FF7E7FA0000-memory.dmp

            Filesize

            64KB

          • memory/3792-143-0x00007FF7E7F90000-0x00007FF7E7FA0000-memory.dmp

            Filesize

            64KB

          • memory/3792-144-0x00007FF7E7F90000-0x00007FF7E7FA0000-memory.dmp

            Filesize

            64KB

          • memory/3792-145-0x00007FF827F10000-0x00007FF828105000-memory.dmp

            Filesize

            2.0MB

          • memory/3792-146-0x00007FF827F10000-0x00007FF828105000-memory.dmp

            Filesize

            2.0MB