Analysis
- max time kernel
167s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
10/02/2022, 07:38
Static task
static1
Behavioral task
behavioral1
Sample
e5c6442649340b5a0778902ecfbe0cec.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target e5c6442649340b5a0778902ecfbe0cec.dll
- Size 351KB
- Sample220210-jgfv3sgcc3
- SHA256 4eae1c5ebdb7b2021913b37477077bde0177579b6f8d43a49bd8a202b45657f4
- MD5 e5c6442649340b5a0778902ecfbe0cec
- SHA1 368859c657c58874ab97167396feaa729304f881
- SHA512 588b3b063212f8487248c0b467e75e145e87f99ab110a61c52463b4af20262597da6a91366f1e2287bde7201d92cc1e34fb1043280d2cfddc950ec09e755c57c
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
gozi_ifsb
Botnet
-
7613
C2
-
interlines.top
-
interlines.space
-
linkspremium.ru
-
premiumlists.ru
Attributes
-
base_path
/drew/
-
build
250225
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50709f73521ed801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30940754" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30940754" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8E9B066D-8A45-11EC-B9A4-FA631BE61B7A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000d1acebaf354ce884beb4132e6c76dcd6a6c99393ee87f5782ec27d2a50a0a82a000000000e80000000020000200000001deeddbbb6b9c414f2a90b13a335616dd21d624307427614f326bb0b83d21bcd20000000bad8ec7288ebef6b90e080032efad020a59f765812c0024458015de125584a72400000006b2849853b8ee1852efa52d80df3c12d8ff4be58ef93c7de1cb28582a92cac12d16b10862fe74568e0d0fe771ceb985ff7a5f34debb585ed33e1cdcded3c7675 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1729057737" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1729057737" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1740 svchost.exe Token: SeCreatePagefilePrivilege 1740 svchost.exe Token: SeShutdownPrivilege 1740 svchost.exe Token: SeCreatePagefilePrivilege 1740 svchost.exe Token: SeShutdownPrivilege 1740 svchost.exe Token: SeCreatePagefilePrivilege 1740 svchost.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe Token: SeRestorePrivilege 2288 TiWorker.exe Token: SeSecurityPrivilege 2288 TiWorker.exe Token: SeBackupPrivilege 2288 TiWorker.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1632 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1632 iexplore.exe 1632 iexplore.exe 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5060 wrote to memory of 4800 5060 regsvr32.exe 83 PID 5060 wrote to memory of 4800 5060 regsvr32.exe 83 PID 5060 wrote to memory of 4800 5060 regsvr32.exe 83 PID 1632 wrote to memory of 2056 1632 iexplore.exe 94 PID 1632 wrote to memory of 2056 1632 iexplore.exe 94 PID 1632 wrote to memory of 2056 1632 iexplore.exe 94
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e5c6442649340b5a0778902ecfbe0cec.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e5c6442649340b5a0778902ecfbe0cec.dll2⤵PID:4800
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:4932
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2056
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:2700
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2288