Analysis
-
max time kernel
165s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-05-2022 23:38
Static task
static1
Behavioral task
behavioral1
Sample
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe
Resource
win10v2004-20220414-en
General
-
Target
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe
-
Size
391KB
-
MD5
423b32ae38b2580f4538057260c6ea97
-
SHA1
257d25308e21fc3049a231680b988554628a82a8
-
SHA256
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d
-
SHA512
2a1509fd1457863cfa68a19509ea6ee7fcda6ff0b3bd7155c24a67c99ab76cc66627f1451485e19b2c8a5c2c9624d0f9af3102bb522cef8a8bcaa0226527cf33
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
apprispl.exepid process 4104 apprispl.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\capigSup = "C:\\Users\\Admin\\AppData\\Roaming\\Azurives\\apprispl.exe" 0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4836 4104 WerFault.exe apprispl.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
apprispl.exepid process 4104 apprispl.exe 4104 apprispl.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.execmd.execmd.exeapprispl.exedescription pid process target process PID 664 wrote to memory of 4620 664 0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe cmd.exe PID 664 wrote to memory of 4620 664 0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe cmd.exe PID 664 wrote to memory of 4620 664 0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe cmd.exe PID 4620 wrote to memory of 4592 4620 cmd.exe cmd.exe PID 4620 wrote to memory of 4592 4620 cmd.exe cmd.exe PID 4620 wrote to memory of 4592 4620 cmd.exe cmd.exe PID 4592 wrote to memory of 4104 4592 cmd.exe apprispl.exe PID 4592 wrote to memory of 4104 4592 cmd.exe apprispl.exe PID 4592 wrote to memory of 4104 4592 cmd.exe apprispl.exe PID 4104 wrote to memory of 4528 4104 apprispl.exe svchost.exe PID 4104 wrote to memory of 4528 4104 apprispl.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe"C:\Users\Admin\AppData\Local\Temp\0809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2B94\10.bat" "C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exe" "C:\Users\Admin\AppData\Local\Temp\0809A7~1.EXE""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exe" "C:\Users\Admin\AppData\Local\Temp\0809A7~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exe"C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exe" "C:\Users\Admin\AppData\Local\Temp\0809A7~1.EXE"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 5685⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4104 -ip 41041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2B94\10.batFilesize
112B
MD55cff5899d878d3627f8755a5ab0d3f7c
SHA1d4596bd3671c7e098fae22a9ffbf0e8d36f39429
SHA256913a18b3b3ab6d8d38087c514051d71b205ce7f3d62a1225be80b911626b922f
SHA5129b002584171d2c9a401716975a34986a317ef025b1e3eb1773b04e2ded6a869b206a9b4f2bf1620a9f950601c20a4fc0703853caa621055707cb7ebdb58e2498
-
C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exeFilesize
391KB
MD5423b32ae38b2580f4538057260c6ea97
SHA1257d25308e21fc3049a231680b988554628a82a8
SHA2560809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d
SHA5122a1509fd1457863cfa68a19509ea6ee7fcda6ff0b3bd7155c24a67c99ab76cc66627f1451485e19b2c8a5c2c9624d0f9af3102bb522cef8a8bcaa0226527cf33
-
C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exeFilesize
391KB
MD5423b32ae38b2580f4538057260c6ea97
SHA1257d25308e21fc3049a231680b988554628a82a8
SHA2560809a74e769d69d7c061cdaf71013b335a0220bec1f135a02927e0e7af32df9d
SHA5122a1509fd1457863cfa68a19509ea6ee7fcda6ff0b3bd7155c24a67c99ab76cc66627f1451485e19b2c8a5c2c9624d0f9af3102bb522cef8a8bcaa0226527cf33
-
memory/664-130-0x0000000000400000-0x0000000000465000-memory.dmpFilesize
404KB
-
memory/664-132-0x0000000002080000-0x00000000020B0000-memory.dmpFilesize
192KB
-
memory/4104-136-0x0000000000000000-mapping.dmp
-
memory/4104-139-0x0000000000400000-0x0000000000465000-memory.dmpFilesize
404KB
-
memory/4104-141-0x0000000000470000-0x00000000004A0000-memory.dmpFilesize
192KB
-
memory/4592-135-0x0000000000000000-mapping.dmp
-
memory/4620-133-0x0000000000000000-mapping.dmp