Analysis
- max time kernel
136s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
26/03/2022, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
40cf9a6c58b28b35ac94bd519b291bee247bbd91fff57fc9a2aa40913fadc776.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
- Target 40cf9a6c58b28b35ac94bd519b291bee247bbd91fff57fc9a2aa40913fadc776.exe
- Size 311KB
- Sample220326-c35yrscbfr
- SHA256 40cf9a6c58b28b35ac94bd519b291bee247bbd91fff57fc9a2aa40913fadc776
- MD5 c6b874efba7800ea74c1c13d0985c9d0
- SHA1 c43c0a58778647708fde852ec4d0ffb7fb3b3708
- SHA512 26a918a36b6e2c4a7c283cd642bddb1858659cdddd86d0809d6fbc8bb70bd6ec06308abda4b0bbbbd2871c85b612db7ccaf15d98d36308a379f116ed5d26c8cb
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
gozi_ifsb
Botnet
-
1001
C2
-
shop.microsoft.com
-
loadshemsplot.xyz
Attributes
-
build
250162
-
dga_season
10
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a000000000200000000001066000000010000200000002bd54b214bc19831ad1c37622be05644322e8dad1cb9209ef67fe26c5ad048a9000000000e8000000002000020000000171f2f862686762aa888b6488a9ebc744715975f54d2c9ccc1a64ee3efcaa1fa2000000070737cf240d7bda8ae1caca09f6dc24ab4ddf36e58404d8d7f3f03d626f2731d40000000ba9e16227d50eb2d357de704203eb73f980ee6d8f70f959689931859ad0e7b4fbefd9fd2f098db579abf20dfc4a95777be8d27d4848c1b219e0b0709e347e9a7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A3B0069A-AD49-11EC-B9A4-724718AA7C81} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a000000000200000000001066000000010000200000007d8278749bc4357f031e19d44d72c83172405e4adaf4fa2204279235946aa156000000000e80000000020000200000006ee2297941579bb11fb7c0e575833dfcf04bc5aeb2757bd4c542f6cc3fb96c732000000053799a8f3aeb3ca165f322c8936858f166eef3714929c20584a366fe8611cb6f400000000072b375ad2535f1c82cfe8a80a610dde05c52a7ec79cf79d349f5f35256c07918276c4e3a11ff6c37002f08ac0ad8323a5d0d9f927b3e08c5128e64e99946ec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000ff32608cddd0d1a5f634fe01e4861224373ed6fc89babde08d511e900c2af55a000000000e800000000200002000000090ddcabc53f6611397ad74a738263bb71c9362996ad004d808f295f481b00591f00000006c20ff82a45184a9fd474fdab053ca970ac2d6f6c69580326fe85ff73f257bc83174824fa55f85222b97437056610ce4c5c59de6a122f977f417c4aff602dca6a841ca709b1e19c5f15d953dd8aac5854c7cc1c283213ace32d599c0abe02e499bad64b06fa36f38a821764e2a7c06bf5ee4cea161f9f9a0f8803cf27901127ff9d7592e1baeec95fc51d7dabfc05b36184da5cb8d01ebc27a7f65fef5b86efb16561096fd604e7e302bb5d3b8c6bec2a7751d6c3a89db574dda0001e38104b4425f4e6707b05c56df0e05da6f2908bcda97a45c03ca00ef8c911c34a4758fee75c586c73dac86e7fc4835ddafd59fa9400000003df924461605dede78b4a75a078bc76f7daf3f3cbf083e3bc51ce179d4c04fd841a961c222433ac6436315c6cb2fae6b652f395f6565371a3a18fcbd1654034c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d514595641d801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7A50E03A-AD49-11EC-B9A4-724718AA7C81} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30949718" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a000000000200000000001066000000010000200000006fb0a09f65c28a104c48bdd1d2be026e2f960825f6cbedc232726eefa563e748000000000e8000000002000020000000d5f8104e2baea2b4925dde077cd9248f5942e270e9ddfa412910b59135e2368e20000000d67f975486fb8670be0910f890b94e03654540c8f39815e99cb66620f1c3c94c400000008ca993373f441cb83bef7eda76e8405ee19fd3ca46d2c671e4c2fa681cb552c0b5fcb5db6a371b77c940a0f25c022fa10ab547ac11c4a468caf2898c5e389ee1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06764505641d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 808d8a505641d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B1383EA5-AD49-11EC-B9A4-724718AA7C81} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1320169423" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000c68f9f9249a62371bc964bf0c53e13b44369ad8bb29b38d11e7390e3a2bfba04000000000e80000000020000200000002eb4e2c293dacb90e741fee55ffdc0e70fc6808ccfe111a3ec6d1a6825e400d3f00000004166256dd07713a8b0c85be388e4ab7cff150441fdd26c3264f5ef407dbd653c3f4fa59818a2f8e4cdc8efba12f66731c17454df92780c60f7eba8f97b44e81c4442a3a5b51cdbdd1c4ee1604f87849b297e7879d4a41d16d263d62afb59f02bdf8ca29cc7779c85e1ce651b966641f05ac623140e8fd014ea4d176230cb54cb4d9ed39dc0ed6d744e8af0a8f53c5bd756805467c8a3c463057f6fe95605c841b74cbe07ffa54de7fe1a93ef82349e8640ef983c07d61020f327e854f6045bd78d92bffde2e817f6e0d9f626e47db22caa7c3c4b61926889473648fc85553e529e6c3794a7597c28197f92ff1e2c58b34000000097c983576dffaa7d7febccd05edaf25c9d8f6c648f51b25f87b419736bf9f21151c4b72712901367245f979e4caafe20092c5328fde68208986d8c3718098806 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.microsoft.com\ = "124" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.microsoft.com IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4748 iexplore.exe 4448 iexplore.exe 2500 iexplore.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4748 iexplore.exe 4748 iexplore.exe 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 4448 iexplore.exe 4448 iexplore.exe 448 IEXPLORE.EXE 448 IEXPLORE.EXE 2500 iexplore.exe 2500 iexplore.exe 3264 IEXPLORE.EXE 3264 IEXPLORE.EXE 5092 IEXPLORE.EXE 5092 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4748 wrote to memory of 2184 4748 iexplore.exe 92 PID 4748 wrote to memory of 2184 4748 iexplore.exe 92 PID 4748 wrote to memory of 2184 4748 iexplore.exe 92 PID 4448 wrote to memory of 448 4448 iexplore.exe 94 PID 4448 wrote to memory of 448 4448 iexplore.exe 94 PID 4448 wrote to memory of 448 4448 iexplore.exe 94 PID 2500 wrote to memory of 3264 2500 iexplore.exe 96 PID 2500 wrote to memory of 3264 2500 iexplore.exe 96 PID 2500 wrote to memory of 3264 2500 iexplore.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\40cf9a6c58b28b35ac94bd519b291bee247bbd91fff57fc9a2aa40913fadc776.exe"C:\Users\Admin\AppData\Local\Temp\40cf9a6c58b28b35ac94bd519b291bee247bbd91fff57fc9a2aa40913fadc776.exe"1⤵PID:1332
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:4372
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4748 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2184
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4448 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:448
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:17410 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:3264
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5092
-