Analysis

  • max time kernel
    147s
  • max time network
    40s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    15-06-2022 00:32

General

  • Target

    2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe

  • Size

    388KB

  • MD5

    26cd3a038676f8e9cebf84a85dbe3668

  • SHA1

    feda5aa1052e306db3a6a73904ea6046b228abe8

  • SHA256

    2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85

  • SHA512

    26b9b4e8f16e82aaea428d77afe92c0ab75cff6fb0bd848433b95e04b51f0da0799c0f48d1a4234ce15ccfa23b229860dda84f5155012bcf3955d0794cfb90ff

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1010

C2

diuolirt.at

deopliazae.at

nifredao.com

filokiyurt.at

Attributes
  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1364
    • C:\Users\Admin\AppData\Local\Temp\2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe
      "C:\Users\Admin\AppData\Local\Temp\2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\9ED2\E1.bat" "C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\2BE8EA~1.EXE""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1352
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C ""C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\2BE8EA~1.EXE""
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:944
          • C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
            "C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\2BE8EA~1.EXE"
            5⤵
            • Executes dropped EXE
            • Deletes itself
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1140
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9ED2\E1.bat
    Filesize

    108B

    MD5

    de65685c95d7ed9dfaceb174b203068a

    SHA1

    bf7e6d7d3e8e62b740e00cfb4a5143718cf0e1bf

    SHA256

    f7cfe957ab64b52f0859cc437da8427662c34a9eb961b4d8775043150b17c357

    SHA512

    614716d509f21a75df71c53778bcd4968780e7491bf928a6ee52e3ccd03f978ba35e660e9e5c3289e5de19b087d3fcbd0feddd6f0b6c5a37c0bf0fdfbeb6ab1d

  • C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
    Filesize

    388KB

    MD5

    26cd3a038676f8e9cebf84a85dbe3668

    SHA1

    feda5aa1052e306db3a6a73904ea6046b228abe8

    SHA256

    2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85

    SHA512

    26b9b4e8f16e82aaea428d77afe92c0ab75cff6fb0bd848433b95e04b51f0da0799c0f48d1a4234ce15ccfa23b229860dda84f5155012bcf3955d0794cfb90ff

  • C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
    Filesize

    388KB

    MD5

    26cd3a038676f8e9cebf84a85dbe3668

    SHA1

    feda5aa1052e306db3a6a73904ea6046b228abe8

    SHA256

    2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85

    SHA512

    26b9b4e8f16e82aaea428d77afe92c0ab75cff6fb0bd848433b95e04b51f0da0799c0f48d1a4234ce15ccfa23b229860dda84f5155012bcf3955d0794cfb90ff

  • \Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
    Filesize

    388KB

    MD5

    26cd3a038676f8e9cebf84a85dbe3668

    SHA1

    feda5aa1052e306db3a6a73904ea6046b228abe8

    SHA256

    2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85

    SHA512

    26b9b4e8f16e82aaea428d77afe92c0ab75cff6fb0bd848433b95e04b51f0da0799c0f48d1a4234ce15ccfa23b229860dda84f5155012bcf3955d0794cfb90ff

  • \Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
    Filesize

    388KB

    MD5

    26cd3a038676f8e9cebf84a85dbe3668

    SHA1

    feda5aa1052e306db3a6a73904ea6046b228abe8

    SHA256

    2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85

    SHA512

    26b9b4e8f16e82aaea428d77afe92c0ab75cff6fb0bd848433b95e04b51f0da0799c0f48d1a4234ce15ccfa23b229860dda84f5155012bcf3955d0794cfb90ff

  • memory/944-60-0x0000000000000000-mapping.dmp
  • memory/1140-69-0x0000000000470000-0x00000000004A0000-memory.dmp
    Filesize

    192KB

  • memory/1140-64-0x0000000000000000-mapping.dmp
  • memory/1140-67-0x0000000000400000-0x0000000000463000-memory.dmp
    Filesize

    396KB

  • memory/1352-58-0x0000000000000000-mapping.dmp
  • memory/1364-74-0x0000000002570000-0x00000000025E5000-memory.dmp
    Filesize

    468KB

  • memory/1364-73-0x0000000002570000-0x00000000025E5000-memory.dmp
    Filesize

    468KB

  • memory/1660-54-0x0000000075F21000-0x0000000075F23000-memory.dmp
    Filesize

    8KB

  • memory/1660-55-0x0000000000400000-0x0000000000463000-memory.dmp
    Filesize

    396KB

  • memory/1660-57-0x00000000002B0000-0x00000000002E0000-memory.dmp
    Filesize

    192KB

  • memory/1784-70-0x0000000000000000-mapping.dmp
  • memory/1784-71-0x00000000001B0000-0x0000000000225000-memory.dmp
    Filesize

    468KB

  • memory/1784-72-0x00000000001B0000-0x0000000000225000-memory.dmp
    Filesize

    468KB