Analysis
- max time kernel
143s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
13/04/2022, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
freeofice.dll
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
General
- Target freeofice.dll
- Size 336KB
- Sample220413-kz463aebc6
- SHA256 29e8bf78ac6bfd95c21e2cbb06a0a9d8088fe9e759673c81eeadd96d681b73ed
- MD5 5e3bf7458c6d8e6e880db72fcdf61f3a
- SHA1 dbe5b4db4b61702f523b86be1d73b742b8d120eb
- SHA512 e752eb1afda0d507b3239eb159fd4d515b73193266f494047262cb0df73ea4ccf83a597efd0d3fefea0c992e0210a48123f0b520a0802ec8fe627872336e53d8
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
gozi_ifsb
Botnet
-
7630
C2
-
nahuinado.top
-
linkspremium.ru
-
premiumlists.ru
Attributes
-
base_path
/drew/
-
build
250225
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6A36AC62-BB1A-11EC-9125-7256EB92F7A9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d53c2d274fd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{42CCCAEF-BB1A-11EC-9125-7256EB92F7A9} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cd2b20274fd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7736FEA1-BB1A-11EC-9125-7256EB92F7A9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "390687543" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006af1d4fbcefdcb48afc82ad132f4f9710000000002000000000010660000000100002000000010142e6bb663ebf3d7b8a51f9b908e84fae0fb3e864d2ee19ecffb9fa7349aed000000000e8000000002000020000000e541d9cd207596ecc76de00decf729f001a0fbcd82e8b2e1ea74f1ff5f834a7020000000a540f57c9d6e18631b0c0b31f75be5e6043773dee88c84d00e9a3860913ea4c940000000afde1b8e30d453cbe758cf03ac7053cf4e1d10fd52f54a7029ee4afd0d0edf964fc9c591e46c706aa64a3ea8ea17a9268f17f2bc4a4a8943cfe1699befcf2cc0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "390687543" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006af1d4fbcefdcb48afc82ad132f4f971000000000200000000001066000000010000200000009ff2899a4bc03e9c9d53dc195a90b23b59b0f21ffcb2ed3a2ea97c0f28173679000000000e8000000002000020000000397183351210fdb2c9b9cccc1a85a9b8213ad793b89fafaef4bc9e04fd211854200000005fbc31356725cf2429e1e5c7a219c55b37fd9ba40be1d96e5622ec963d58f12740000000c3ff72fb4c20d70404192235283636d62cac5a0b9e79dd9047488e79612e2de024ff6c379d9bbe679e565a873c65f1c359bccfd9402322845bfd2f4cfb109566 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30953255" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5D38C2EE-BB1A-11EC-9125-7256EB92F7A9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b002771c274fd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006af1d4fbcefdcb48afc82ad132f4f97100000000020000000000106600000001000020000000c977b75e6039af7483a702829fbee1f43ca6781195967d2b3fc9569f3464b419000000000e80000000020000200000002a4fb92556d308d8b2bd69fd564ab4481dcae0b9c5a7db104f804849ddd097052000000090f7dc9623a9d08173db23d5ec1af45f2e1fdf25fe24f3075779e1c66992cf944000000019458e994fbf577f23e69d997a446c20db19fa4db10449a1c360cd37b327c745302647b3566ded891df65fdd050547e75037ebe0f1ed8caa27a3fc9e9c37bd1a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03c3919274fd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006af1d4fbcefdcb48afc82ad132f4f971000000000200000000001066000000010000200000009cfc4788533d67c24f89d1869fb148845893777ec339142325279052f7258c10000000000e8000000002000020000000648c4d00024686868f2e895ff05f341b69e01b6e58f1237eb1e749e5eb6ad4c8200000009c4505fe46dbd44189fa8090db1c3c012bf1cebbe5b109207d9809684b2303b24000000072d9db9be7468b7849354873fdd74fa2c1c81798d04f9df0adfc89ec6b999018e397a7da96fb5e15cfdba8c8e60666f7f1c26424dbf204c51131f217052b7950 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006af1d4fbcefdcb48afc82ad132f4f97100000000020000000000106600000001000020000000f1063a17dac26ff9cdd88604ad0592836990d9bc0fa1274b1bc97e35aee98f0d000000000e8000000002000020000000dd119f8fc8a79d0f7a192f9d49f8e7d5b0136e60d41bc1b80893a7c9e0f1e45a200000008e550ef8523153f01f563626f14122b5bc3e73c6032932be1cef91dd5bdb399e40000000457f1eb1e36f43356fac26ae12e53e38f372334c3aec87f686086218f868c12c7d657d69308bbcd46263e7f3c34d8af098fd87c7a09dce7241a721cc31e4b5db iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30953255" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00f363a274fd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4284 iexplore.exe 1496 iexplore.exe 5100 iexplore.exe 636 iexplore.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 4284 iexplore.exe 4284 iexplore.exe 1408 IEXPLORE.EXE 1408 IEXPLORE.EXE 1496 iexplore.exe 1496 iexplore.exe 4616 IEXPLORE.EXE 4616 IEXPLORE.EXE 5100 iexplore.exe 5100 iexplore.exe 4292 IEXPLORE.EXE 4292 IEXPLORE.EXE 636 iexplore.exe 636 iexplore.exe 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4676 wrote to memory of 4756 4676 rundll32.exe 80 PID 4676 wrote to memory of 4756 4676 rundll32.exe 80 PID 4676 wrote to memory of 4756 4676 rundll32.exe 80 PID 4284 wrote to memory of 1408 4284 iexplore.exe 90 PID 4284 wrote to memory of 1408 4284 iexplore.exe 90 PID 4284 wrote to memory of 1408 4284 iexplore.exe 90 PID 1496 wrote to memory of 4616 1496 iexplore.exe 104 PID 1496 wrote to memory of 4616 1496 iexplore.exe 104 PID 1496 wrote to memory of 4616 1496 iexplore.exe 104 PID 5100 wrote to memory of 4292 5100 iexplore.exe 106 PID 5100 wrote to memory of 4292 5100 iexplore.exe 106 PID 5100 wrote to memory of 4292 5100 iexplore.exe 106 PID 636 wrote to memory of 2264 636 iexplore.exe 108 PID 636 wrote to memory of 2264 636 iexplore.exe 108 PID 636 wrote to memory of 2264 636 iexplore.exe 108
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\freeofice.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\freeofice.dll,#12⤵PID:4756
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:5056
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4284 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1408
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1496 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4616
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5100 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4292
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:636 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2264
-