Analysis
-
max time kernel
158s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14-06-2022 21:27
Static task
static1
Behavioral task
behavioral1
Sample
2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe
Resource
win10v2004-20220414-en
General
-
Target
2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe
-
Size
851KB
-
MD5
356803d58538c6e67cba97dc1cf50021
-
SHA1
56a643fd5d4b927cad2b5c7cf9c92103d426344c
-
SHA256
2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e
-
SHA512
c05207089b1dd8ccd65268e9b2aa948f2df3a2c1d0f714ca24326a27a62fbdcb3fdf4214213c89f781d130850c8ff38422e407f7f807231436956fdc00b5d465
Malware Config
Extracted
gozi_ifsb
92
http://aaxvkah7dudzoloq.onion
http://mashallah.at
http://anumal-planet.at
-
build
217027
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Signatures
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfshngle = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypider\\bridclen.exe" Explorer.EXE -
Suspicious use of SetThreadContext 7 IoCs
Processes:
2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.execontrol.exeExplorer.EXEdescription pid process target process PID 2236 set thread context of 4732 2236 2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe control.exe PID 4732 set thread context of 3148 4732 control.exe Explorer.EXE PID 3148 set thread context of 3636 3148 Explorer.EXE RuntimeBroker.exe PID 3148 set thread context of 3864 3148 Explorer.EXE RuntimeBroker.exe PID 4732 set thread context of 4232 4732 control.exe rundll32.exe PID 3148 set thread context of 4516 3148 Explorer.EXE RuntimeBroker.exe PID 3148 set thread context of 3084 3148 Explorer.EXE cmd.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exeExplorer.EXEpid process 2236 2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe 2236 2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe 2236 2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe 2236 2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe 3148 Explorer.EXE 3148 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3148 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.execontrol.exeExplorer.EXEpid process 2236 2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe 4732 control.exe 3148 Explorer.EXE 3148 Explorer.EXE 4732 control.exe 3148 Explorer.EXE 3148 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Explorer.EXERuntimeBroker.exedescription pid process Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3636 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3148 Explorer.EXE -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.execontrol.exeExplorer.EXEcmd.exedescription pid process target process PID 2236 wrote to memory of 4732 2236 2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe control.exe PID 2236 wrote to memory of 4732 2236 2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe control.exe PID 2236 wrote to memory of 4732 2236 2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe control.exe PID 2236 wrote to memory of 4732 2236 2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe control.exe PID 2236 wrote to memory of 4732 2236 2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe control.exe PID 4732 wrote to memory of 3148 4732 control.exe Explorer.EXE PID 4732 wrote to memory of 3148 4732 control.exe Explorer.EXE PID 4732 wrote to memory of 3148 4732 control.exe Explorer.EXE PID 3148 wrote to memory of 3636 3148 Explorer.EXE RuntimeBroker.exe PID 3148 wrote to memory of 3636 3148 Explorer.EXE RuntimeBroker.exe PID 3148 wrote to memory of 3636 3148 Explorer.EXE RuntimeBroker.exe PID 3148 wrote to memory of 3864 3148 Explorer.EXE RuntimeBroker.exe PID 4732 wrote to memory of 4232 4732 control.exe rundll32.exe PID 4732 wrote to memory of 4232 4732 control.exe rundll32.exe PID 4732 wrote to memory of 4232 4732 control.exe rundll32.exe PID 3148 wrote to memory of 3864 3148 Explorer.EXE RuntimeBroker.exe PID 3148 wrote to memory of 3864 3148 Explorer.EXE RuntimeBroker.exe PID 3148 wrote to memory of 4516 3148 Explorer.EXE RuntimeBroker.exe PID 4732 wrote to memory of 4232 4732 control.exe rundll32.exe PID 4732 wrote to memory of 4232 4732 control.exe rundll32.exe PID 3148 wrote to memory of 4516 3148 Explorer.EXE RuntimeBroker.exe PID 3148 wrote to memory of 4516 3148 Explorer.EXE RuntimeBroker.exe PID 3148 wrote to memory of 1304 3148 Explorer.EXE cmd.exe PID 3148 wrote to memory of 1304 3148 Explorer.EXE cmd.exe PID 1304 wrote to memory of 4392 1304 cmd.exe nslookup.exe PID 1304 wrote to memory of 4392 1304 cmd.exe nslookup.exe PID 3148 wrote to memory of 4384 3148 Explorer.EXE cmd.exe PID 3148 wrote to memory of 4384 3148 Explorer.EXE cmd.exe PID 3148 wrote to memory of 3084 3148 Explorer.EXE cmd.exe PID 3148 wrote to memory of 3084 3148 Explorer.EXE cmd.exe PID 3148 wrote to memory of 3084 3148 Explorer.EXE cmd.exe PID 3148 wrote to memory of 3084 3148 Explorer.EXE cmd.exe PID 3148 wrote to memory of 3084 3148 Explorer.EXE cmd.exe PID 3148 wrote to memory of 3084 3148 Explorer.EXE cmd.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe"C:\Users\Admin\AppData\Local\Temp\2cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\control.exeC:\Windows\system32\control.exe /?3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?4⤵
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\6B0F.bi1"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\6B0F.bi1"2⤵
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6B0F.bi1Filesize
118B
MD5ace7e9f29953c4fbd6a930b50f792079
SHA197511e3438221ac9c30944fca7b91e87978c1248
SHA25658b498e17cfc59584aae9620ca60d657e3691c7bfc1896e581f3f9292390bfd8
SHA5125dc35105667f0e1231fd21b85a7dbc65f207251efbbe173545d8f0172272b0ad68cc084514f8b034b998194a4e63b29ffb862243c65bf14ab0eba3ee2d081106
-
C:\Users\Admin\AppData\Local\Temp\6B0F.bi1Filesize
118B
MD5ace7e9f29953c4fbd6a930b50f792079
SHA197511e3438221ac9c30944fca7b91e87978c1248
SHA25658b498e17cfc59584aae9620ca60d657e3691c7bfc1896e581f3f9292390bfd8
SHA5125dc35105667f0e1231fd21b85a7dbc65f207251efbbe173545d8f0172272b0ad68cc084514f8b034b998194a4e63b29ffb862243c65bf14ab0eba3ee2d081106
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypider\bridclen.exeFilesize
851KB
MD5356803d58538c6e67cba97dc1cf50021
SHA156a643fd5d4b927cad2b5c7cf9c92103d426344c
SHA2562cd9bc76624eebb8dd89600ca372b1de083a96d8e868eda0e974a7b2f58fc14e
SHA512c05207089b1dd8ccd65268e9b2aa948f2df3a2c1d0f714ca24326a27a62fbdcb3fdf4214213c89f781d130850c8ff38422e407f7f807231436956fdc00b5d465
-
memory/1304-149-0x0000000000000000-mapping.dmp
-
memory/2236-131-0x0000000000400000-0x00000000004DB000-memory.dmpFilesize
876KB
-
memory/2236-132-0x00000000022D0000-0x000000000231A000-memory.dmpFilesize
296KB
-
memory/2236-130-0x0000000002DC0000-0x0000000002DF3000-memory.dmpFilesize
204KB
-
memory/3084-156-0x00000000013A0000-0x0000000001444000-memory.dmpFilesize
656KB
-
memory/3084-155-0x0000000000036B20-0x0000000000036B24-memory.dmpFilesize
4B
-
memory/3084-154-0x0000000000000000-mapping.dmp
-
memory/3148-145-0x0000000002F80000-0x0000000003031000-memory.dmpFilesize
708KB
-
memory/3636-146-0x0000017C29440000-0x0000017C294F1000-memory.dmpFilesize
708KB
-
memory/3864-147-0x0000020383700000-0x00000203837B1000-memory.dmpFilesize
708KB
-
memory/4232-143-0x00000187C8B00000-0x00000187C8BB1000-memory.dmpFilesize
708KB
-
memory/4232-142-0x0000000000000000-mapping.dmp
-
memory/4384-151-0x0000000000000000-mapping.dmp
-
memory/4392-150-0x0000000000000000-mapping.dmp
-
memory/4516-148-0x00000225E6680000-0x00000225E6731000-memory.dmpFilesize
708KB
-
memory/4732-144-0x0000000000C90000-0x0000000000D41000-memory.dmpFilesize
708KB
-
memory/4732-140-0x0000000000C90000-0x0000000000D41000-memory.dmpFilesize
708KB
-
memory/4732-139-0x0000000000000000-mapping.dmp