General
Target

b3be1dd63db308b92cc3704faa396da6b544f3ab4e212f62de3aab9326229be1.exe

Filesize

908KB

Completed

20-05-2022 21:23

Task

behavioral1

Score
10/10
MD5

3c1429579cb97febfe58dc0f8cd6fbe9

SHA1

79885de392a4b5776522b28ef7b9ed5dd9d5319c

SHA256

b3be1dd63db308b92cc3704faa396da6b544f3ab4e212f62de3aab9326229be1

SHA512

a4bf3829c8fd4b983846d52c3fc10608ff631abb0b355a738f9c5128697c0464e06c5b10f75215eab643f98e09b220da21adf4a74fdc807ff1ed5da0f2e58484

Malware Config

Extracted

Family

gozi_rm3

Attributes
build
300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes
build
300854
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12
url_path
index.htm
rsa_pubkey.plain
serpent.plain
Signatures 5

Filter: none

Defense Evasion
  • Gozi RM3

    Description

    A heavily modified version of Gozi using RM3 loader.

  • Modifies Internet Explorer settings
    iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoomiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetupiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b000000000200000000001066000000010000200000006ff1219400b5cdf9e24654adfacfff4a4e4d0a48191548a1f3717009fe5d06b8000000000e8000000002000020000000f2b64fadcf6a5010008d8db57f05951286310141c6823d681388b2f77e1d180e90000000ac4850206aae39248dd9cd482064f4c9c8ddcbaf6508ce4f4fbfe35a2f24671f05119bef7bcc0d7f2684b3352b5ff87db1913f373b930f27897539b8c82b155c9dac2827471c96d877cb2f852198e82db2ce62e282001781519b1e1ac0db42f048bec7865fc9bf64aea83070047a6ba745ab7360b7f6c9c437cb14670f64d454cba3abd24939fa89cb5d7cffedbe789a4000000052e134e7268cf88898b6506bcc3a39d890f40a4da8d406e31fd6d7deb1f25f455ed2987af00dba1081b7c393c0519bb714f3a5c0a6538fab10662ded1ef9c206iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowseriexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetupiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ca14a08f6cd801iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000b31dd16e077969a7eb2a8bd245ba7c8172914c76463abe8e4a26ef652bd2ec4c000000000e8000000002000020000000f0dc325dedecba0e3d90a1db6e877edaa2a2cae50ac92105685fd9044c25fc6d20000000c4758019106075d9dcaa8cc2d7aa64c038985490cc63d6b9d66838dc2b85cac9400000002ec6d070f5a8a671af8fc2344bac73ef832552c0fcdc6dfbfd0dcf6fc6bd69eba89e7075ceea5846f455180eb2bdc4937c92453ad776d9fc344a2556eb7c784ciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliFormsiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPUiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBA92211-D882-11EC-917F-6AE7990DC39D} = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMiciexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistryiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDA30251-D882-11EC-917F-6AE7990DC39D} = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoomiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliFormsiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPUiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbariexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliFormsiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbariexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowseriexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04531D51-D883-11EC-917F-6AE7990DC39D} = "0"iexplore.exe
  • Suspicious use of FindShellTrayWindow
    iexplore.exeiexplore.exeiexplore.exe

    Reported IOCs

    pidprocess
    1508iexplore.exe
    1508iexplore.exe
    1228iexplore.exe
    1332iexplore.exe
  • Suspicious use of SetWindowsHookEx
    iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

    Reported IOCs

    pidprocess
    1508iexplore.exe
    1508iexplore.exe
    760IEXPLORE.EXE
    760IEXPLORE.EXE
    1508iexplore.exe
    1508iexplore.exe
    2004IEXPLORE.EXE
    2004IEXPLORE.EXE
    1228iexplore.exe
    1228iexplore.exe
    1096IEXPLORE.EXE
    1096IEXPLORE.EXE
    1332iexplore.exe
    1332iexplore.exe
    1424IEXPLORE.EXE
    1424IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    iexplore.exeiexplore.exeiexplore.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1508 wrote to memory of 7601508iexplore.exeIEXPLORE.EXE
    PID 1508 wrote to memory of 7601508iexplore.exeIEXPLORE.EXE
    PID 1508 wrote to memory of 7601508iexplore.exeIEXPLORE.EXE
    PID 1508 wrote to memory of 7601508iexplore.exeIEXPLORE.EXE
    PID 1508 wrote to memory of 20041508iexplore.exeIEXPLORE.EXE
    PID 1508 wrote to memory of 20041508iexplore.exeIEXPLORE.EXE
    PID 1508 wrote to memory of 20041508iexplore.exeIEXPLORE.EXE
    PID 1508 wrote to memory of 20041508iexplore.exeIEXPLORE.EXE
    PID 1228 wrote to memory of 10961228iexplore.exeIEXPLORE.EXE
    PID 1228 wrote to memory of 10961228iexplore.exeIEXPLORE.EXE
    PID 1228 wrote to memory of 10961228iexplore.exeIEXPLORE.EXE
    PID 1228 wrote to memory of 10961228iexplore.exeIEXPLORE.EXE
    PID 1332 wrote to memory of 14241332iexplore.exeIEXPLORE.EXE
    PID 1332 wrote to memory of 14241332iexplore.exeIEXPLORE.EXE
    PID 1332 wrote to memory of 14241332iexplore.exeIEXPLORE.EXE
    PID 1332 wrote to memory of 14241332iexplore.exeIEXPLORE.EXE
Processes 8
  • C:\Users\Admin\AppData\Local\Temp\b3be1dd63db308b92cc3704faa396da6b544f3ab4e212f62de3aab9326229be1.exe
    "C:\Users\Admin\AppData\Local\Temp\b3be1dd63db308b92cc3704faa396da6b544f3ab4e212f62de3aab9326229be1.exe"
    PID:1668
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1508 CREDAT:275457 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:760
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1508 CREDAT:472074 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2004
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:275457 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1096
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1332 CREDAT:275457 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1424
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/1668-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

                        • memory/1668-55-0x0000000000230000-0x000000000023C000-memory.dmp

                        • memory/1668-56-0x0000000000400000-0x00000000004E5000-memory.dmp

                        • memory/1668-57-0x0000000000270000-0x0000000000281000-memory.dmp