Analysis
-
max time kernel
90s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-06-2022 00:54
Static task
static1
Behavioral task
behavioral1
Sample
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe
Resource
win10v2004-20220414-en
General
-
Target
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe
-
Size
388KB
-
MD5
47a7fcfbab8ff08c6363e4094e6ce93b
-
SHA1
9d90222513625aab4120e17930cfe5f600ed2018
-
SHA256
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2
-
SHA512
478f52c5e1ecbac59242f8151b08fff3038564fbca3a05dd5f2fd3ed4dd819c56483f2e8ccdfcf1abaa4ce870b64e06b54f204176e8260a854f2502105ca0643
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Actipi32.exepid process 1476 Actipi32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AcWioker = "C:\\Users\\Admin\\AppData\\Roaming\\Addrdlet\\Actipi32.exe" 23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3868 1476 WerFault.exe Actipi32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Actipi32.exepid process 1476 Actipi32.exe 1476 Actipi32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.execmd.execmd.exeActipi32.exedescription pid process target process PID 5004 wrote to memory of 4572 5004 23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe cmd.exe PID 5004 wrote to memory of 4572 5004 23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe cmd.exe PID 5004 wrote to memory of 4572 5004 23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe cmd.exe PID 4572 wrote to memory of 3904 4572 cmd.exe cmd.exe PID 4572 wrote to memory of 3904 4572 cmd.exe cmd.exe PID 4572 wrote to memory of 3904 4572 cmd.exe cmd.exe PID 3904 wrote to memory of 1476 3904 cmd.exe Actipi32.exe PID 3904 wrote to memory of 1476 3904 cmd.exe Actipi32.exe PID 3904 wrote to memory of 1476 3904 cmd.exe Actipi32.exe PID 1476 wrote to memory of 4856 1476 Actipi32.exe svchost.exe PID 1476 wrote to memory of 4856 1476 Actipi32.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe"C:\Users\Admin\AppData\Local\Temp\23a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\745A\11.bat" "C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe" "C:\Users\Admin\AppData\Local\Temp\23A14E~1.EXE""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe" "C:\Users\Admin\AppData\Local\Temp\23A14E~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe"C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe" "C:\Users\Admin\AppData\Local\Temp\23A14E~1.EXE"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 5685⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1476 -ip 14761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\745A\11.batFilesize
112B
MD503a90e9113b82652c530c7854595526b
SHA1cf683aa6cc756cbf49748bb1a2678712a09ee8fd
SHA256adf6bb3941e5e411f78aca795daa2f4e61fcc46d293ba884f2299f9f38be6db6
SHA512c830c4354cb74d4e8df698f07c164e3cfe52c9f64a50abc58c61c043976046c6826606b645cdc04046222f1bc8f168501e0bdfa1ab9a2cd84ab0c556d2aad906
-
C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exeFilesize
388KB
MD547a7fcfbab8ff08c6363e4094e6ce93b
SHA19d90222513625aab4120e17930cfe5f600ed2018
SHA25623a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2
SHA512478f52c5e1ecbac59242f8151b08fff3038564fbca3a05dd5f2fd3ed4dd819c56483f2e8ccdfcf1abaa4ce870b64e06b54f204176e8260a854f2502105ca0643
-
C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exeFilesize
388KB
MD547a7fcfbab8ff08c6363e4094e6ce93b
SHA19d90222513625aab4120e17930cfe5f600ed2018
SHA25623a14ea3e60c8669ed7d69c03c5bbfb6bd4998c7679e047f0b312a3bb1b747f2
SHA512478f52c5e1ecbac59242f8151b08fff3038564fbca3a05dd5f2fd3ed4dd819c56483f2e8ccdfcf1abaa4ce870b64e06b54f204176e8260a854f2502105ca0643
-
memory/1476-136-0x0000000000000000-mapping.dmp
-
memory/1476-139-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/1476-141-0x0000000001F50000-0x0000000001F80000-memory.dmpFilesize
192KB
-
memory/3904-135-0x0000000000000000-mapping.dmp
-
memory/4572-133-0x0000000000000000-mapping.dmp
-
memory/5004-130-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/5004-132-0x00000000005D0000-0x0000000000600000-memory.dmpFilesize
192KB