Analysis

  • max time kernel
    32s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24/05/2022, 23:22

General

  • Target

    5710dad3353443c91aa4106b0af16230b115d78468507ad566f688a875c1e80b.exe

  • Size

    908KB

  • MD5

    22cd38a6c266266eb156c23ed7cf6f16

  • SHA1

    10c228c51c487affa95026534f88e8389244557f

  • SHA256

    5710dad3353443c91aa4106b0af16230b115d78468507ad566f688a875c1e80b

  • SHA512

    2bd4a9a75249f1f529a1d2db8b7c94ec8896859453a426769fae5850d96dcfcd202247ac9243491a960cc587cf6e1158b5f676d929a4836ca10cd45d293f7ecc

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes
  • build

    300854

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5710dad3353443c91aa4106b0af16230b115d78468507ad566f688a875c1e80b.exe
    "C:\Users\Admin\AppData\Local\Temp\5710dad3353443c91aa4106b0af16230b115d78468507ad566f688a875c1e80b.exe"
    1⤵
      PID:3568
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:4776
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4688
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4688 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4676
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4688 CREDAT:82950 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4060
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
          PID:796
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:17410 /prefetch:2
            2⤵
              PID:3908
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
            1⤵
              PID:1456
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1456 CREDAT:17410 /prefetch:2
                2⤵
                  PID:4952
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                1⤵
                  PID:4048
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4048 CREDAT:17410 /prefetch:2
                    2⤵
                      PID:1432
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                    1⤵
                      PID:3140
                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3140 CREDAT:17410 /prefetch:2
                        2⤵
                          PID:1296

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/3568-130-0x0000000000780000-0x000000000078C000-memory.dmp

                        Filesize

                        48KB

                      • memory/3568-131-0x0000000000400000-0x00000000004E5000-memory.dmp

                        Filesize

                        916KB

                      • memory/3568-132-0x00000000007A0000-0x00000000007B1000-memory.dmp

                        Filesize

                        68KB