Analysis
-
max time kernel
146s -
max time network
40s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-06-2022 00:54
Static task
static1
Behavioral task
behavioral1
Sample
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe
Resource
win10v2004-20220414-en
General
-
Target
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe
-
Size
388KB
-
MD5
47a7fcfbab8ff08c6363e4094e6ce93b
-
SHA1
9d90222513625aab4120e17930cfe5f600ed2018
-
SHA256
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2
-
SHA512
478f52c5e1ecbac59242f8151b08fff3038564fbca3a05dd5f2fd3ed4dd819c56483f2e8ccdfcf1abaa4ce870b64e06b54f204176e8260a854f2502105ca0643
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ACCTient.exepid process 940 ACCTient.exe -
Deletes itself 1 IoCs
Processes:
ACCTient.exepid process 940 ACCTient.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 984 cmd.exe 984 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audiedit = "C:\\Users\\Admin\\AppData\\Roaming\\bitsmuid\\ACCTient.exe" 23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ACCTient.exesvchost.exedescription pid process target process PID 940 set thread context of 1756 940 ACCTient.exe svchost.exe PID 1756 set thread context of 1364 1756 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ACCTient.exeExplorer.EXEpid process 940 ACCTient.exe 1364 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
ACCTient.exesvchost.exepid process 940 ACCTient.exe 1756 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE 1364 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE 1364 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.execmd.execmd.exeACCTient.exesvchost.exedescription pid process target process PID 1000 wrote to memory of 1976 1000 23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe cmd.exe PID 1000 wrote to memory of 1976 1000 23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe cmd.exe PID 1000 wrote to memory of 1976 1000 23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe cmd.exe PID 1000 wrote to memory of 1976 1000 23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe cmd.exe PID 1976 wrote to memory of 984 1976 cmd.exe cmd.exe PID 1976 wrote to memory of 984 1976 cmd.exe cmd.exe PID 1976 wrote to memory of 984 1976 cmd.exe cmd.exe PID 1976 wrote to memory of 984 1976 cmd.exe cmd.exe PID 984 wrote to memory of 940 984 cmd.exe ACCTient.exe PID 984 wrote to memory of 940 984 cmd.exe ACCTient.exe PID 984 wrote to memory of 940 984 cmd.exe ACCTient.exe PID 984 wrote to memory of 940 984 cmd.exe ACCTient.exe PID 940 wrote to memory of 1756 940 ACCTient.exe svchost.exe PID 940 wrote to memory of 1756 940 ACCTient.exe svchost.exe PID 940 wrote to memory of 1756 940 ACCTient.exe svchost.exe PID 940 wrote to memory of 1756 940 ACCTient.exe svchost.exe PID 940 wrote to memory of 1756 940 ACCTient.exe svchost.exe PID 940 wrote to memory of 1756 940 ACCTient.exe svchost.exe PID 940 wrote to memory of 1756 940 ACCTient.exe svchost.exe PID 1756 wrote to memory of 1364 1756 svchost.exe Explorer.EXE PID 1756 wrote to memory of 1364 1756 svchost.exe Explorer.EXE PID 1756 wrote to memory of 1364 1756 svchost.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe"C:\Users\Admin\AppData\Local\Temp\23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\A3B2\31.bat" "C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\23A14E~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\23A14E~1.EXE""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe"C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\23A14E~1.EXE"5⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\A3B2\31.batFilesize
108B
MD5e7550e44121fe66c24064dcfe5f83a63
SHA1c82ee730dd23a4fd3d9abbe8af2c3af2784468b7
SHA256d8cb96f3a3a9b8bc07c9d26857f01151ecc22d96b84797833efaeb17a6ef4952
SHA51237b3a5595dd4a7f17a0fdba9685be2a8ac1f9a8b3427248cb997ada4d2adeafde3779fc0b2b2f92bcd03c09fea6f222700745495edb19e30ffb30ca3c195ae02
-
C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exeFilesize
388KB
MD547a7fcfbab8ff08c6363e4094e6ce93b
SHA19d90222513625aab4120e17930cfe5f600ed2018
SHA25623a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2
SHA512478f52c5e1ecbac59242f8151b08fff3038564fbca3a05dd5f2fd3ed4dd819c56483f2e8ccdfcf1abaa4ce870b64e06b54f204176e8260a854f2502105ca0643
-
C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exeFilesize
388KB
MD547a7fcfbab8ff08c6363e4094e6ce93b
SHA19d90222513625aab4120e17930cfe5f600ed2018
SHA25623a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2
SHA512478f52c5e1ecbac59242f8151b08fff3038564fbca3a05dd5f2fd3ed4dd819c56483f2e8ccdfcf1abaa4ce870b64e06b54f204176e8260a854f2502105ca0643
-
\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exeFilesize
388KB
MD547a7fcfbab8ff08c6363e4094e6ce93b
SHA19d90222513625aab4120e17930cfe5f600ed2018
SHA25623a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2
SHA512478f52c5e1ecbac59242f8151b08fff3038564fbca3a05dd5f2fd3ed4dd819c56483f2e8ccdfcf1abaa4ce870b64e06b54f204176e8260a854f2502105ca0643
-
\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exeFilesize
388KB
MD547a7fcfbab8ff08c6363e4094e6ce93b
SHA19d90222513625aab4120e17930cfe5f600ed2018
SHA25623a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2
SHA512478f52c5e1ecbac59242f8151b08fff3038564fbca3a05dd5f2fd3ed4dd819c56483f2e8ccdfcf1abaa4ce870b64e06b54f204176e8260a854f2502105ca0643
-
memory/940-67-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/940-64-0x0000000000000000-mapping.dmp
-
memory/940-69-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/984-60-0x0000000000000000-mapping.dmp
-
memory/1000-57-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/1000-54-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1000-55-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/1364-73-0x0000000002570000-0x00000000025E5000-memory.dmpFilesize
468KB
-
memory/1364-74-0x0000000002570000-0x00000000025E5000-memory.dmpFilesize
468KB
-
memory/1756-70-0x0000000000000000-mapping.dmp
-
memory/1756-71-0x00000000003B0000-0x0000000000425000-memory.dmpFilesize
468KB
-
memory/1756-72-0x00000000003B0000-0x0000000000425000-memory.dmpFilesize
468KB
-
memory/1976-58-0x0000000000000000-mapping.dmp