Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    14/06/2022, 23:45

General

  • Target

    2c21e78c2ae52a2aedc97822579343b2f8e63455de97645d6dc52a50d3a2fe31.exe

  • Size

    752KB

  • MD5

    8bc39d61f41a5c6dfac7ad4dc9e158c6

  • SHA1

    1192620ceb20e80fcfdf93ef2b81e5e142d0a4cc

  • SHA256

    2c21e78c2ae52a2aedc97822579343b2f8e63455de97645d6dc52a50d3a2fe31

  • SHA512

    3b4e3bad2c14be164abf0b0b9e263bda2c349bafce2d19c93156d226f43df384882285b7cb5162f19c5645da9a242ea99108110135ff7fc362c9d3c943d92464

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1000

C2

vachiderk.com

siberponis.com

Attributes
  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Accesses Microsoft Outlook accounts
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\2c21e78c2ae52a2aedc97822579343b2f8e63455de97645d6dc52a50d3a2fe31.exe
      "C:\Users\Admin\AppData\Local\Temp\2c21e78c2ae52a2aedc97822579343b2f8e63455de97645d6dc52a50d3a2fe31.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3152
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8C42\4621.bat" "C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe" "C:\Users\Admin\AppData\Local\Temp\2C21E7~1.EXE""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C ""C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe" "C:\Users\Admin\AppData\Local\Temp\2C21E7~1.EXE""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3780
          • C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe
            "C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe" "C:\Users\Admin\AppData\Local\Temp\2C21E7~1.EXE"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:236
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:1500
    • C:\Windows\system32\cmd.exe
      cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\8218.bin1"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Windows\system32\systeminfo.exe
        systeminfo.exe
        3⤵
        • Gathers system information
        PID:1596
    • C:\Windows\system32\cmd.exe
      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8218.bin1"
      2⤵
        PID:4884
      • C:\Windows\system32\cmd.exe
        cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\8218.bin1"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\Windows\system32\net.exe
          net view
          3⤵
          • Discovers systems in the same network
          PID:1952
      • C:\Windows\system32\cmd.exe
        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8218.bin1"
        2⤵
          PID:2932
        • C:\Windows\system32\cmd.exe
          cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\8218.bin1"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4804
          • C:\Windows\system32\nslookup.exe
            nslookup 127.0.0.1
            3⤵
              PID:4516
          • C:\Windows\system32\cmd.exe
            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8218.bin1"
            2⤵
              PID:4512
            • C:\Windows\system32\cmd.exe
              cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\8218.bin1"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4152
              • C:\Windows\system32\tasklist.exe
                tasklist.exe /SVC
                3⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:3720
            • C:\Windows\system32\cmd.exe
              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8218.bin1"
              2⤵
                PID:4048
              • C:\Windows\system32\cmd.exe
                cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\8218.bin1"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1420
                • C:\Windows\system32\driverquery.exe
                  driverquery.exe
                  3⤵
                    PID:1940
                • C:\Windows\system32\cmd.exe
                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8218.bin1"
                  2⤵
                    PID:3136
                  • C:\Windows\system32\cmd.exe
                    cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\8218.bin1"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4116
                    • C:\Windows\system32\reg.exe
                      reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                      3⤵
                        PID:4004
                    • C:\Windows\system32\cmd.exe
                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8218.bin1"
                      2⤵
                        PID:528
                      • C:\Windows\system32\cmd.exe
                        cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\8218.bin1 > C:\Users\Admin\AppData\Local\Temp\8218.bin & del C:\Users\Admin\AppData\Local\Temp\8218.bin1"
                        2⤵
                          PID:1184
                        • C:\Windows\system32\makecab.exe
                          makecab.exe /F "C:\Users\Admin\AppData\Local\Temp\D265.bin"
                          2⤵
                            PID:3436

                        Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin

                                Filesize

                                64KB

                                MD5

                                9eea7682e14d0811e09a5f863e9297a0

                                SHA1

                                45b7f976b49756adb2221d4069be3a671caab302

                                SHA256

                                7f23d5c7c800c820e3794df7f892a5ec934048e09615f8057a2795f95e30bdfe

                                SHA512

                                069c89529dfc42d0a0c779b60ab6e142fbf68521f30fbe84ec99fa2164cfe8b5a9ae6bc980d11df8aba902c70f9654fe00bd275ac449d1c3a11b2e705537af61

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin

                                Filesize

                                64KB

                                MD5

                                9eea7682e14d0811e09a5f863e9297a0

                                SHA1

                                45b7f976b49756adb2221d4069be3a671caab302

                                SHA256

                                7f23d5c7c800c820e3794df7f892a5ec934048e09615f8057a2795f95e30bdfe

                                SHA512

                                069c89529dfc42d0a0c779b60ab6e142fbf68521f30fbe84ec99fa2164cfe8b5a9ae6bc980d11df8aba902c70f9654fe00bd275ac449d1c3a11b2e705537af61

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin1

                                Filesize

                                2KB

                                MD5

                                d98f59834dccc66309ced19ad44f311d

                                SHA1

                                9e1c8bdf6db391f25980f80f8e96838789c34570

                                SHA256

                                1686e3f47744baca25b6b3d2280ddd7e5e55e66edc733cecad968eee50c20f3c

                                SHA512

                                c0aa2344a041da9e04a5cdb84a157cf8e6544def179f21b266bf219a77fafbe8bbd09442bf8f577288ed11b8c94c2ddffa82801e2b6a9eaad32d70e8069a01bd

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin1

                                Filesize

                                2KB

                                MD5

                                d98f59834dccc66309ced19ad44f311d

                                SHA1

                                9e1c8bdf6db391f25980f80f8e96838789c34570

                                SHA256

                                1686e3f47744baca25b6b3d2280ddd7e5e55e66edc733cecad968eee50c20f3c

                                SHA512

                                c0aa2344a041da9e04a5cdb84a157cf8e6544def179f21b266bf219a77fafbe8bbd09442bf8f577288ed11b8c94c2ddffa82801e2b6a9eaad32d70e8069a01bd

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin1

                                Filesize

                                2KB

                                MD5

                                4af7a207e872080a115ccd8e175524fb

                                SHA1

                                416d91f08bf3f530cc9cb53c95dde88d224cc95c

                                SHA256

                                51f81cc0b6888bd52e8570a41f697ea62fb5bd76baf679716ccb3133de4deb42

                                SHA512

                                5a88d1b37032d8d0e1f9728b4f63107f3c3e8d6f3183dad06f725f0204d8f32e553490d52a5885907db35baa57ffd4948c82e65e2b401b2265a125b1985e0cba

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin1

                                Filesize

                                2KB

                                MD5

                                f02cbc43ab8c908677c531da59e4b3f5

                                SHA1

                                f6c88f1e3b75e206f71ed4ab685bb3beb6e41394

                                SHA256

                                4cfab6f7734c43adb38b111680328b02cb24daccf0f06d888fe376adc0c75e70

                                SHA512

                                5cfacf85826d9f7710ce06262cabdf9958b137c2d098636782f3cac194130ee90eb62f05f5247e24a5bc134c7ea1fcfec4299c833307bb4710cce7c69b54941e

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin1

                                Filesize

                                2KB

                                MD5

                                f02cbc43ab8c908677c531da59e4b3f5

                                SHA1

                                f6c88f1e3b75e206f71ed4ab685bb3beb6e41394

                                SHA256

                                4cfab6f7734c43adb38b111680328b02cb24daccf0f06d888fe376adc0c75e70

                                SHA512

                                5cfacf85826d9f7710ce06262cabdf9958b137c2d098636782f3cac194130ee90eb62f05f5247e24a5bc134c7ea1fcfec4299c833307bb4710cce7c69b54941e

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin1

                                Filesize

                                9KB

                                MD5

                                f6c7ca305aea91134643d1c04801e68b

                                SHA1

                                4a236c34329f86f2f9f9e33cd0be3393e52ba7e8

                                SHA256

                                f76a676ce889c3d8950e185e904a626341240c006434e991fad8a66f2e4287ec

                                SHA512

                                44cd8dc6ba6daf64025b6805be6ef82960c37d494b3182bed93177fad1ef2eb52f361e204e3db2ac82a991f3d4ced74ba77f4d4bae4b3fab82c5145c01f8f7ee

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin1

                                Filesize

                                9KB

                                MD5

                                f6c7ca305aea91134643d1c04801e68b

                                SHA1

                                4a236c34329f86f2f9f9e33cd0be3393e52ba7e8

                                SHA256

                                f76a676ce889c3d8950e185e904a626341240c006434e991fad8a66f2e4287ec

                                SHA512

                                44cd8dc6ba6daf64025b6805be6ef82960c37d494b3182bed93177fad1ef2eb52f361e204e3db2ac82a991f3d4ced74ba77f4d4bae4b3fab82c5145c01f8f7ee

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin1

                                Filesize

                                35KB

                                MD5

                                d5123e06673c663f87423483a277955d

                                SHA1

                                90c16e2a299aa13f3556dbe919b3f09eefc400b6

                                SHA256

                                f8bae5be58a7f830d658dcc4c594b32c00a08f1754b7e6aac3c233f123b172e9

                                SHA512

                                36badf8b4b03cfb620175e1d9fcad6734bc09f993425f98682c07515fa1916f97dcd21ba6b5c615a133052a2993cae99b76fd946daefebb3da4ef3e847b53dec

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin1

                                Filesize

                                35KB

                                MD5

                                d5123e06673c663f87423483a277955d

                                SHA1

                                90c16e2a299aa13f3556dbe919b3f09eefc400b6

                                SHA256

                                f8bae5be58a7f830d658dcc4c594b32c00a08f1754b7e6aac3c233f123b172e9

                                SHA512

                                36badf8b4b03cfb620175e1d9fcad6734bc09f993425f98682c07515fa1916f97dcd21ba6b5c615a133052a2993cae99b76fd946daefebb3da4ef3e847b53dec

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin1

                                Filesize

                                64KB

                                MD5

                                9eea7682e14d0811e09a5f863e9297a0

                                SHA1

                                45b7f976b49756adb2221d4069be3a671caab302

                                SHA256

                                7f23d5c7c800c820e3794df7f892a5ec934048e09615f8057a2795f95e30bdfe

                                SHA512

                                069c89529dfc42d0a0c779b60ab6e142fbf68521f30fbe84ec99fa2164cfe8b5a9ae6bc980d11df8aba902c70f9654fe00bd275ac449d1c3a11b2e705537af61

                              • C:\Users\Admin\AppData\Local\Temp\8218.bin1

                                Filesize

                                64KB

                                MD5

                                9eea7682e14d0811e09a5f863e9297a0

                                SHA1

                                45b7f976b49756adb2221d4069be3a671caab302

                                SHA256

                                7f23d5c7c800c820e3794df7f892a5ec934048e09615f8057a2795f95e30bdfe

                                SHA512

                                069c89529dfc42d0a0c779b60ab6e142fbf68521f30fbe84ec99fa2164cfe8b5a9ae6bc980d11df8aba902c70f9654fe00bd275ac449d1c3a11b2e705537af61

                              • C:\Users\Admin\AppData\Local\Temp\8C42\4621.bat

                                Filesize

                                112B

                                MD5

                                93d118118810cff1584a112fa4086fe5

                                SHA1

                                d219d8fb69639b464ddbe73cbcd3b9ed6fb6ba40

                                SHA256

                                1cdae7d4d4cca1ddbdafabaf0a199b49421ce7c9798684208882113de858f1d9

                                SHA512

                                29aa24286eda22f861f49d3372689b6edd4b6f84ca7afa47a498f73df20906d8951675988347bef03797f56f4936ea7adcfa2380aee93eb49fcbffae0ee94ece

                              • C:\Users\Admin\AppData\Local\Temp\D265.bin

                                Filesize

                                153B

                                MD5

                                af26c91505f4978d7f34b6224c4fb049

                                SHA1

                                92cbb1dc67ca226b2d2f53e70bbdb3fa08914b3c

                                SHA256

                                51d5bfff01953dfec651362304346b2bd5461086d6256fc862f5304bcd6f6542

                                SHA512

                                07d2c6171dcff6ff2cae483adbbb12f582a457401ee3b902826ef7657f498007ddf3b3eb74b30039668752c3c5749a91ed934f86734f1d208f34af6b318f7119

                              • C:\Users\Admin\AppData\Local\Temp\DB09.bin

                                Filesize

                                10KB

                                MD5

                                d94d1b42146a38260dfd9ec24cd537be

                                SHA1

                                0200f5c20a05609b26a0b4cd87d81e43c976c7f7

                                SHA256

                                0713e9f4a7767b02417b652764e017dfa3bd6c30a7471ddbca521ffb367d3e69

                                SHA512

                                02c45bbc6edcb781908ef709455200edfdc168fc134b5f36b3d436ea5f211fd7e644af0e93365b5222566fa856298d8a6b7fb6d1d9d99811386568fbddc8985f

                              • C:\Users\Admin\AppData\Local\Temp\setup.inf

                                Filesize

                                929B

                                MD5

                                5f81b025bbf39e2459d660a0431e73b2

                                SHA1

                                0945caa77d94d62dd3412c459a994ffe750fea75

                                SHA256

                                dcc6d51c4a8c1a0013043fa3ec6473a81e497df7a66e8df017a4b5e1b7542f5f

                                SHA512

                                98d1ffe5a7b946bb1fa0ab86766c7d232e1eb8c9087d6b1b2023b0511a6e012fa79dc72e04c1e9f9191727f77a54e46de6e099c020e40b39a495c3d8b34a31d5

                              • C:\Users\Admin\AppData\Local\Temp\setup.rpt

                                Filesize

                                283B

                                MD5

                                5b421c22949692fdfb495c4b549a169f

                                SHA1

                                dcc91642ac7c33f631b64294379b580784858fa0

                                SHA256

                                9d4f66fcfc55f5a35491013a747f1ee05e8702e4687d5e52165ca35f9d8e9a12

                                SHA512

                                740b72c705a00169988923f8563c588a1675a9e469d9e367c8bf1e57b21f442dcae68c8fa1f50f812cfd150d8cdfc2597d03bc4539a4d09a6afe7c2c6c04f581

                              • C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe

                                Filesize

                                752KB

                                MD5

                                8bc39d61f41a5c6dfac7ad4dc9e158c6

                                SHA1

                                1192620ceb20e80fcfdf93ef2b81e5e142d0a4cc

                                SHA256

                                2c21e78c2ae52a2aedc97822579343b2f8e63455de97645d6dc52a50d3a2fe31

                                SHA512

                                3b4e3bad2c14be164abf0b0b9e263bda2c349bafce2d19c93156d226f43df384882285b7cb5162f19c5645da9a242ea99108110135ff7fc362c9d3c943d92464

                              • C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe

                                Filesize

                                752KB

                                MD5

                                8bc39d61f41a5c6dfac7ad4dc9e158c6

                                SHA1

                                1192620ceb20e80fcfdf93ef2b81e5e142d0a4cc

                                SHA256

                                2c21e78c2ae52a2aedc97822579343b2f8e63455de97645d6dc52a50d3a2fe31

                                SHA512

                                3b4e3bad2c14be164abf0b0b9e263bda2c349bafce2d19c93156d226f43df384882285b7cb5162f19c5645da9a242ea99108110135ff7fc362c9d3c943d92464

                              • memory/1500-141-0x00000000000A0000-0x00000000001D1000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2996-142-0x0000000007BC0000-0x0000000007CF1000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2996-144-0x0000000007BC0000-0x0000000007CF1000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/3152-132-0x00000000022A0000-0x00000000022C0000-memory.dmp

                                Filesize

                                128KB

                              • memory/3152-130-0x0000000000400000-0x00000000004BE000-memory.dmp

                                Filesize

                                760KB