Analysis
-
max time kernel
56s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 21:33
Behavioral task
behavioral1
Sample
68511f1825391b79c703d63aa23463e920c866ec506ae067014f8226d6366f33.exe
Resource
win7-20220414-en
General
-
Target
68511f1825391b79c703d63aa23463e920c866ec506ae067014f8226d6366f33.exe
-
Size
908KB
-
MD5
7d03263195d980077822bf5b1e8d0b02
-
SHA1
abae4572f4e7681cd074006775e6c232f03036bc
-
SHA256
68511f1825391b79c703d63aa23463e920c866ec506ae067014f8226d6366f33
-
SHA512
4b6ca5c8a13d8a51f8a83a69e973c48590791d8ba36083be8039c26e889f9ac547a62f1f29f496cd35cf3bcd5f46fc5cd1d49df2af18158a47a98b8f6799e345
Malware Config
Extracted
gozi_rm3
-
build
300854
Extracted
gozi_rm3
202004141
https://devicelease.xyz
-
build
300854
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2AC711A1-DBBA-11EC-8939-C6DEEDF3EE1E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 2016 iexplore.exe 2016 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 2016 iexplore.exe 2016 iexplore.exe 1144 IEXPLORE.EXE 1144 IEXPLORE.EXE 2016 iexplore.exe 2016 iexplore.exe 520 IEXPLORE.EXE 520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
iexplore.exedescription pid process target process PID 2016 wrote to memory of 1144 2016 iexplore.exe IEXPLORE.EXE PID 2016 wrote to memory of 1144 2016 iexplore.exe IEXPLORE.EXE PID 2016 wrote to memory of 1144 2016 iexplore.exe IEXPLORE.EXE PID 2016 wrote to memory of 1144 2016 iexplore.exe IEXPLORE.EXE PID 2016 wrote to memory of 520 2016 iexplore.exe IEXPLORE.EXE PID 2016 wrote to memory of 520 2016 iexplore.exe IEXPLORE.EXE PID 2016 wrote to memory of 520 2016 iexplore.exe IEXPLORE.EXE PID 2016 wrote to memory of 520 2016 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\68511f1825391b79c703d63aa23463e920c866ec506ae067014f8226d6366f33.exe"C:\Users\Admin\AppData\Local\Temp\68511f1825391b79c703d63aa23463e920c866ec506ae067014f8226d6366f33.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275465 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:275457 /prefetch:22⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OIDKHO4K.txtFilesize
599B
MD59665b9d2f421b5bccf2050dd782670ef
SHA13640099ee16096f8fc27ce6a11568909ace5063e
SHA2566a62e0105173c8c0e078691be6789ae28e9105251d12c26396409c9af2c92d4f
SHA5125f6ba483659038da33ac068f4d80d9bb9241b9d1f4e520869b5b4b804411fc71c1246734ebc52ae44f20d19474d0ea6f061a9c270ea565049116e35171c6729d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-msFilesize
3KB
MD52240edd7f2001426fdd4ec71a881a03e
SHA189a6270c6e628de4b8f0e9aa13d498fc57232604
SHA2565bc666ec92f1dcf1d105a990dbb1011dba66bad069f477b1db18cac409fd3429
SHA5122f8a3be7bac6262b8bb4ca08bf44a139cdb10032ae24a16d2627bdaeb88f802ccc59aa5557c8d4c7ad6068d6078f8cdf2b7e28a34caa35a492ff58403706b337
-
memory/1164-54-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/1164-55-0x0000000000220000-0x000000000022C000-memory.dmpFilesize
48KB
-
memory/1164-56-0x0000000000400000-0x00000000004E5000-memory.dmpFilesize
916KB
-
memory/1164-57-0x0000000000240000-0x0000000000251000-memory.dmpFilesize
68KB