Analysis

  • max time kernel
    91s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-05-2022 00:12

General

  • Target

    0c2fdd1cf54726053f476f0a622516296f74d05080cba267d299fe88aa95d96f.exe

  • Size

    619KB

  • MD5

    023633aabeaf85cacd110b117c8294ab

  • SHA1

    78d1d0e1e2151c90e152c8ee7ea0b8677a26f332

  • SHA256

    0c2fdd1cf54726053f476f0a622516296f74d05080cba267d299fe88aa95d96f

  • SHA512

    57a89791e4feac8f909c30762a2c757a81ace876a2e9e1d0b07f266bf175b5899fcdae93afa0cbf0c78fdace0368cf6e7d5d060d3119fd55ae434ffb6584f505

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300900

Extracted

Family

gozi_rm3

Botnet

90020242

C2

https://vrhgroups.xyz

Attributes
  • build

    300900

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c2fdd1cf54726053f476f0a622516296f74d05080cba267d299fe88aa95d96f.exe
    "C:\Users\Admin\AppData\Local\Temp\0c2fdd1cf54726053f476f0a622516296f74d05080cba267d299fe88aa95d96f.exe"
    1⤵
      PID:1708
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1832
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2036
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
        PID:880
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:880 CREDAT:275457 /prefetch:2
          2⤵
            PID:1656
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
            PID:272
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:272 CREDAT:275457 /prefetch:2
              2⤵
                PID:240
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
              1⤵
                PID:692
                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:692 CREDAT:275457 /prefetch:2
                  2⤵
                    PID:1820

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/1708-54-0x0000000075A61000-0x0000000075A63000-memory.dmp

                  Filesize

                  8KB

                • memory/1708-56-0x0000000000400000-0x000000000049B000-memory.dmp

                  Filesize

                  620KB

                • memory/1708-55-0x0000000000220000-0x0000000000248000-memory.dmp

                  Filesize

                  160KB

                • memory/1708-57-0x0000000000300000-0x0000000000316000-memory.dmp

                  Filesize

                  88KB