Analysis
-
max time kernel
4294204s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
24-03-2022 19:22
Static task
static1
Behavioral task
behavioral1
Sample
738bf94c6e4e07f3eb40859954b3be1ddcb035b44f28c2225e72d323856d43eb.dll
Resource
win7-20220311-en
General
-
Target
738bf94c6e4e07f3eb40859954b3be1ddcb035b44f28c2225e72d323856d43eb.dll
-
Size
205KB
-
MD5
da15c7e12929023bd011008236d018fd
-
SHA1
fc1764997075e265dd02d7e6beb7f2fcd482d802
-
SHA256
738bf94c6e4e07f3eb40859954b3be1ddcb035b44f28c2225e72d323856d43eb
-
SHA512
5c849bab270fe90b51383e071d17595c877a7f895062b3f90e6af41984e11c2edef5a0684d01f33327d6ae9909e6c583f6afd97818de58375525f9c8f586b12b
Malware Config
Extracted
gozi_rm3
-
build
300932
Extracted
gozi_rm3
201193206
https://lalstatsnon.website
-
build
300932
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
Signatures
-
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAA78751-ABCD-11EC-9B6B-DE7689C81ED7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C649FDD1-ABCD-11EC-9B6B-DE7689C81ED7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc00000000020000000000106600000001000020000000781c8a3692b62644e3c684b4678f85a960b1543e331a37d9f6c3299af8825eef000000000e8000000002000020000000d7d0d1c230bdc2adaa6392cf2e5f68e91679040ea8719f495de6dd1662cf59c6900000003306faed52a5679ed2322b55457e0863852b27b1eaa7d77286beeb7506086eebfe29cffe84cbd28e634cd563ecb12417b730d7b32aa1eefab38b82f28bc52b2ca04bacb6c25fae64ac58bf20d6f1a24356520dfc78641902fd627b678dacbc4f0e100848b9027974d370f167d5de2c676f74e96ae05e0e40da0f28f86a018c98b10c8504b483366d36ccb67094fd65d840000000116c5ae00f59752e8b16d03b72b78faeba8066dfeabcc649c808a1de9bfe50a0835b2782d0c02e0ca812b5b04d86c15b0e7af6c6b0156fb65208bf5c038e2d9a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc00000000020000000000106600000001000020000000f925cfeb45ec47ace5931bd1d08afc7fbf113e604671fb96c4e53f2528709e6c000000000e8000000002000020000000ef9bf808f67849a0dc5d0e12de8038c446642fc923798fbc06a462b7e3cfe8a6200000007aa0e943ad35770e6cff2c883d552c8a98f76c59db409c97eed86d852d86188d40000000d2335a3c5ce4006ad81fd49fa72aeea7c217e133d74494908c3be6b4af10ebbabb1119105f9e675b123404ad2da068d7d26b67a18b4bb6bd839ac643dbeabffe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exepid process 1552 iexplore.exe 1100 iexplore.exe 1288 iexplore.exe 1552 iexplore.exe 1672 iexplore.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 1552 iexplore.exe 1552 iexplore.exe 936 IEXPLORE.EXE 936 IEXPLORE.EXE 1100 iexplore.exe 1100 iexplore.exe 464 IEXPLORE.EXE 464 IEXPLORE.EXE 1288 iexplore.exe 1288 iexplore.exe 844 IEXPLORE.EXE 844 IEXPLORE.EXE 1552 iexplore.exe 1552 iexplore.exe 1284 IEXPLORE.EXE 1284 IEXPLORE.EXE 1672 iexplore.exe 1672 iexplore.exe 1040 IEXPLORE.EXE 1040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
rundll32.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 1584 wrote to memory of 520 1584 rundll32.exe rundll32.exe PID 1584 wrote to memory of 520 1584 rundll32.exe rundll32.exe PID 1584 wrote to memory of 520 1584 rundll32.exe rundll32.exe PID 1584 wrote to memory of 520 1584 rundll32.exe rundll32.exe PID 1584 wrote to memory of 520 1584 rundll32.exe rundll32.exe PID 1584 wrote to memory of 520 1584 rundll32.exe rundll32.exe PID 1584 wrote to memory of 520 1584 rundll32.exe rundll32.exe PID 1552 wrote to memory of 936 1552 iexplore.exe IEXPLORE.EXE PID 1552 wrote to memory of 936 1552 iexplore.exe IEXPLORE.EXE PID 1552 wrote to memory of 936 1552 iexplore.exe IEXPLORE.EXE PID 1552 wrote to memory of 936 1552 iexplore.exe IEXPLORE.EXE PID 1100 wrote to memory of 464 1100 iexplore.exe IEXPLORE.EXE PID 1100 wrote to memory of 464 1100 iexplore.exe IEXPLORE.EXE PID 1100 wrote to memory of 464 1100 iexplore.exe IEXPLORE.EXE PID 1100 wrote to memory of 464 1100 iexplore.exe IEXPLORE.EXE PID 1288 wrote to memory of 844 1288 iexplore.exe IEXPLORE.EXE PID 1288 wrote to memory of 844 1288 iexplore.exe IEXPLORE.EXE PID 1288 wrote to memory of 844 1288 iexplore.exe IEXPLORE.EXE PID 1288 wrote to memory of 844 1288 iexplore.exe IEXPLORE.EXE PID 1552 wrote to memory of 1284 1552 iexplore.exe IEXPLORE.EXE PID 1552 wrote to memory of 1284 1552 iexplore.exe IEXPLORE.EXE PID 1552 wrote to memory of 1284 1552 iexplore.exe IEXPLORE.EXE PID 1552 wrote to memory of 1284 1552 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 1040 1672 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 1040 1672 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 1040 1672 iexplore.exe IEXPLORE.EXE PID 1672 wrote to memory of 1040 1672 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\738bf94c6e4e07f3eb40859954b3be1ddcb035b44f28c2225e72d323856d43eb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\738bf94c6e4e07f3eb40859954b3be1ddcb035b44f28c2225e72d323856d43eb.dll,#12⤵PID:520
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:936
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:464
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:844
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1284
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1040
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
cf1efd3d28139752aa4fd2a1693c54ba
SHA1a901e82eb24c32e816ef213e3e6afae0b1a23276
SHA25626075673cf6a6b64433c3c44f292768f564dde54c84dbb4d1a100704aab3a4b2
SHA512949d6aa320ea0182b12b9bfab8c6c0c2f6884d84d3b706f06e3cf78f86175abc2ae13ab26789fcaf31afc12d269e0ced3167e580cb9e63440d29d0d65bc83ec2
-
MD5
cf1efd3d28139752aa4fd2a1693c54ba
SHA1a901e82eb24c32e816ef213e3e6afae0b1a23276
SHA25626075673cf6a6b64433c3c44f292768f564dde54c84dbb4d1a100704aab3a4b2
SHA512949d6aa320ea0182b12b9bfab8c6c0c2f6884d84d3b706f06e3cf78f86175abc2ae13ab26789fcaf31afc12d269e0ced3167e580cb9e63440d29d0d65bc83ec2
-
MD5
cf1efd3d28139752aa4fd2a1693c54ba
SHA1a901e82eb24c32e816ef213e3e6afae0b1a23276
SHA25626075673cf6a6b64433c3c44f292768f564dde54c84dbb4d1a100704aab3a4b2
SHA512949d6aa320ea0182b12b9bfab8c6c0c2f6884d84d3b706f06e3cf78f86175abc2ae13ab26789fcaf31afc12d269e0ced3167e580cb9e63440d29d0d65bc83ec2
-
MD5
cf1efd3d28139752aa4fd2a1693c54ba
SHA1a901e82eb24c32e816ef213e3e6afae0b1a23276
SHA25626075673cf6a6b64433c3c44f292768f564dde54c84dbb4d1a100704aab3a4b2
SHA512949d6aa320ea0182b12b9bfab8c6c0c2f6884d84d3b706f06e3cf78f86175abc2ae13ab26789fcaf31afc12d269e0ced3167e580cb9e63440d29d0d65bc83ec2