Analysis

  • max time kernel
    55s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-05-2022 00:08

General

  • Target

    89cb0c7c835e9a8f77e78f26c0ee38f83bf9da8b31dcd08ed9326fdd3958f534.exe

  • Size

    619KB

  • MD5

    f243b66901d4a69ded543d8bd4bc8db5

  • SHA1

    603f66c0f68441528fe1ab7b39d1023fef266c3d

  • SHA256

    89cb0c7c835e9a8f77e78f26c0ee38f83bf9da8b31dcd08ed9326fdd3958f534

  • SHA512

    f092cb8565f0d346025b7e70069a8c218e07f07f151a6a37c624f63baf71bd46e00bfef6225722d5c2128de8fd397111d485036d1545cd07530d6b4fb5fe6ff7

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300900

  • exe_type

    loader

Extracted

Family

gozi_rm3

Botnet

90020242

C2

https://vrhgroups.xyz

Attributes
  • build

    300900

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnLBIFd8ENlbWBR6Mve3hFdwUQ
3
KngeHDeI6ZHfdoSY5iiGvcAu6O6F+f9hBJzYA9LsJqVLMvXTQMahO053kuqc9pRN
4
TJW6SoyOgLPfMhl5Q2+9qBvWUQzDH3vbOrJD0p79sTnfsMikRQ6+wVQ9+g++o28i
5
eNAgaJpU4bqwW1JmawIDAQAB
6
-----END PUBLIC KEY-----
serpent.plain
1
GixufGwVe0SpF7gm

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89cb0c7c835e9a8f77e78f26c0ee38f83bf9da8b31dcd08ed9326fdd3958f534.exe
    "C:\Users\Admin\AppData\Local\Temp\89cb0c7c835e9a8f77e78f26c0ee38f83bf9da8b31dcd08ed9326fdd3958f534.exe"
    1⤵
      PID:3600
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:4812
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4804 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:3504
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
          PID:2988
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:17410 /prefetch:2
            2⤵
              PID:4068
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
            1⤵
              PID:2640
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:17410 /prefetch:2
                2⤵
                  PID:2608
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                1⤵
                  PID:1572
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1572 CREDAT:17410 /prefetch:2
                    2⤵
                      PID:1912
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                    1⤵
                      PID:2332
                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:17410 /prefetch:2
                        2⤵
                          PID:4988
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                        1⤵
                          PID:1036
                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1036 CREDAT:17410 /prefetch:2
                            2⤵
                              PID:400
                          • C:\Program Files\Internet Explorer\iexplore.exe
                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                            1⤵
                              PID:1648
                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:17410 /prefetch:2
                                2⤵
                                  PID:2076
                              • C:\Program Files\Internet Explorer\iexplore.exe
                                "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                1⤵
                                  PID:3880
                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3880 CREDAT:17410 /prefetch:2
                                    2⤵
                                      PID:3504

                                  Network

                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    15.89.54.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    15.89.54.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    14.110.152.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    14.110.152.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • flag-us
                                    DNS
                                    vrhgroups.xyz
                                    IEXPLORE.EXE
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    vrhgroups.xyz
                                    IN A
                                    Response
                                  • 93.184.220.29:80
                                    322 B
                                    7
                                  • 104.110.191.133:80
                                    322 B
                                    7
                                  • 104.110.191.133:80
                                    322 B
                                    7
                                  • 20.189.173.15:443
                                    322 B
                                    7
                                  • 104.110.191.133:80
                                    322 B
                                    7
                                  • 104.110.191.133:80
                                    322 B
                                    7
                                  • 104.110.191.133:80
                                    322 B
                                    7
                                  • 93.184.220.29:80
                                    260 B
                                    5
                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    15.89.54.20.in-addr.arpa
                                    dns
                                    70 B
                                    156 B
                                    1
                                    1

                                    DNS Request

                                    15.89.54.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    14.110.152.52.in-addr.arpa
                                    dns
                                    72 B
                                    146 B
                                    1
                                    1

                                    DNS Request

                                    14.110.152.52.in-addr.arpa

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  • 8.8.8.8:53
                                    vrhgroups.xyz
                                    dns
                                    IEXPLORE.EXE
                                    59 B
                                    124 B
                                    1
                                    1

                                    DNS Request

                                    vrhgroups.xyz

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • memory/3600-130-0x0000000000610000-0x0000000000626000-memory.dmp

                                    Filesize

                                    88KB

                                  • memory/3600-137-0x0000000000400000-0x000000000049B000-memory.dmp

                                    Filesize

                                    620KB

                                  • memory/3600-136-0x00000000021F0000-0x0000000002218000-memory.dmp

                                    Filesize

                                    160KB

                                  We care about your privacy.

                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.