Analysis
-
max time kernel
164s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-05-2022 23:38
Static task
static1
Behavioral task
behavioral1
Sample
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe
Resource
win10v2004-20220414-en
General
-
Target
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe
-
Size
391KB
-
MD5
423b32ae38b2580f4538057260c6ea97
-
SHA1
257d25308e21fc3049a231680b988554628a82a8
-
SHA256
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d
-
SHA512
2a1509fd1457863cfa68a19509ea6ee7fcda6ff0b3bd7155c24a67c99ab76cc66627f1451485e19b2c8a5c2c9624d0f9af3102bb522cef8a8bcaa0226527cf33
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
authuthz.exepid process 1724 authuthz.exe -
Deletes itself 1 IoCs
Processes:
authuthz.exepid process 1724 authuthz.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2028 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\aecaCore = "C:\\Users\\Admin\\AppData\\Roaming\\clictall\\authuthz.exe" 0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
authuthz.exesvchost.exedescription pid process target process PID 1724 set thread context of 1648 1724 authuthz.exe svchost.exe PID 1648 set thread context of 1212 1648 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
authuthz.exeExplorer.EXEpid process 1724 authuthz.exe 1212 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
authuthz.exesvchost.exepid process 1724 authuthz.exe 1648 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 1212 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.execmd.execmd.exeauthuthz.exesvchost.exedescription pid process target process PID 1472 wrote to memory of 1708 1472 0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe cmd.exe PID 1472 wrote to memory of 1708 1472 0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe cmd.exe PID 1472 wrote to memory of 1708 1472 0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe cmd.exe PID 1472 wrote to memory of 1708 1472 0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe cmd.exe PID 1708 wrote to memory of 2028 1708 cmd.exe cmd.exe PID 1708 wrote to memory of 2028 1708 cmd.exe cmd.exe PID 1708 wrote to memory of 2028 1708 cmd.exe cmd.exe PID 1708 wrote to memory of 2028 1708 cmd.exe cmd.exe PID 2028 wrote to memory of 1724 2028 cmd.exe authuthz.exe PID 2028 wrote to memory of 1724 2028 cmd.exe authuthz.exe PID 2028 wrote to memory of 1724 2028 cmd.exe authuthz.exe PID 2028 wrote to memory of 1724 2028 cmd.exe authuthz.exe PID 1724 wrote to memory of 1648 1724 authuthz.exe svchost.exe PID 1724 wrote to memory of 1648 1724 authuthz.exe svchost.exe PID 1724 wrote to memory of 1648 1724 authuthz.exe svchost.exe PID 1724 wrote to memory of 1648 1724 authuthz.exe svchost.exe PID 1724 wrote to memory of 1648 1724 authuthz.exe svchost.exe PID 1724 wrote to memory of 1648 1724 authuthz.exe svchost.exe PID 1724 wrote to memory of 1648 1724 authuthz.exe svchost.exe PID 1648 wrote to memory of 1212 1648 svchost.exe Explorer.EXE PID 1648 wrote to memory of 1212 1648 svchost.exe Explorer.EXE PID 1648 wrote to memory of 1212 1648 svchost.exe Explorer.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe"C:\Users\Admin\AppData\Local\Temp\0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\8144\13.bat" "C:\Users\Admin\AppData\Roaming\clictall\authuthz.exe" "C:\Users\Admin\AppData\Local\Temp\0809A7~1.EXE""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\clictall\authuthz.exe" "C:\Users\Admin\AppData\Local\Temp\0809A7~1.EXE""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\clictall\authuthz.exe"C:\Users\Admin\AppData\Roaming\clictall\authuthz.exe" "C:\Users\Admin\AppData\Local\Temp\0809A7~1.EXE"4⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8144\13.batFilesize
108B
MD55ca8f39f2bcabc960fb8dada0622b079
SHA1a7d25bfd37345725c60b68335355ff328ecf56ee
SHA256441d1634ffa1f987d9d817f1f9e14aec1c30fe94db2b7ba801680a3aa414d053
SHA5129e275e2ffa4ebe40ad0f8d04ae008590d6969b4adf64c256dc7b71c9b25ef9e4a317aba344e13cbb69234446b291f6118d5985d5c842d4b12a5ae82a9502609c
-
C:\Users\Admin\AppData\Roaming\clictall\authuthz.exeFilesize
391KB
MD5423b32ae38b2580f4538057260c6ea97
SHA1257d25308e21fc3049a231680b988554628a82a8
SHA2560809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d
SHA5122a1509fd1457863cfa68a19509ea6ee7fcda6ff0b3bd7155c24a67c99ab76cc66627f1451485e19b2c8a5c2c9624d0f9af3102bb522cef8a8bcaa0226527cf33
-
C:\Users\Admin\AppData\Roaming\clictall\authuthz.exeFilesize
391KB
MD5423b32ae38b2580f4538057260c6ea97
SHA1257d25308e21fc3049a231680b988554628a82a8
SHA2560809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d
SHA5122a1509fd1457863cfa68a19509ea6ee7fcda6ff0b3bd7155c24a67c99ab76cc66627f1451485e19b2c8a5c2c9624d0f9af3102bb522cef8a8bcaa0226527cf33
-
\Users\Admin\AppData\Roaming\clictall\authuthz.exeFilesize
391KB
MD5423b32ae38b2580f4538057260c6ea97
SHA1257d25308e21fc3049a231680b988554628a82a8
SHA2560809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d
SHA5122a1509fd1457863cfa68a19509ea6ee7fcda6ff0b3bd7155c24a67c99ab76cc66627f1451485e19b2c8a5c2c9624d0f9af3102bb522cef8a8bcaa0226527cf33
-
memory/1212-73-0x0000000002B10000-0x0000000002B85000-memory.dmpFilesize
468KB
-
memory/1212-72-0x0000000002B10000-0x0000000002B85000-memory.dmpFilesize
468KB
-
memory/1472-55-0x0000000000400000-0x0000000000465000-memory.dmpFilesize
404KB
-
memory/1472-57-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB
-
memory/1472-54-0x0000000076C81000-0x0000000076C83000-memory.dmpFilesize
8KB
-
memory/1648-70-0x0000000000150000-0x00000000001C5000-memory.dmpFilesize
468KB
-
memory/1648-69-0x0000000000000000-mapping.dmp
-
memory/1648-71-0x0000000000150000-0x00000000001C5000-memory.dmpFilesize
468KB
-
memory/1708-58-0x0000000000000000-mapping.dmp
-
memory/1724-68-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB
-
memory/1724-63-0x0000000000000000-mapping.dmp
-
memory/2028-60-0x0000000000000000-mapping.dmp