Analysis
-
max time kernel
126s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 00:32
Static task
static1
Behavioral task
behavioral1
Sample
2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe
Resource
win10v2004-20220414-en
General
-
Target
2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe
-
Size
388KB
-
MD5
26cd3a038676f8e9cebf84a85dbe3668
-
SHA1
feda5aa1052e306db3a6a73904ea6046b228abe8
-
SHA256
2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85
-
SHA512
26b9b4e8f16e82aaea428d77afe92c0ab75cff6fb0bd848433b95e04b51f0da0799c0f48d1a4234ce15ccfa23b229860dda84f5155012bcf3955d0794cfb90ff
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
AcGeecfc.exepid process 4456 AcGeecfc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Contager = "C:\\Users\\Admin\\AppData\\Roaming\\Bingutil\\AcGeecfc.exe" 2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4880 4456 WerFault.exe AcGeecfc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AcGeecfc.exepid process 4456 AcGeecfc.exe 4456 AcGeecfc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.execmd.execmd.exeAcGeecfc.exedescription pid process target process PID 4692 wrote to memory of 1508 4692 2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe cmd.exe PID 4692 wrote to memory of 1508 4692 2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe cmd.exe PID 4692 wrote to memory of 1508 4692 2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe cmd.exe PID 1508 wrote to memory of 2760 1508 cmd.exe cmd.exe PID 1508 wrote to memory of 2760 1508 cmd.exe cmd.exe PID 1508 wrote to memory of 2760 1508 cmd.exe cmd.exe PID 2760 wrote to memory of 4456 2760 cmd.exe AcGeecfc.exe PID 2760 wrote to memory of 4456 2760 cmd.exe AcGeecfc.exe PID 2760 wrote to memory of 4456 2760 cmd.exe AcGeecfc.exe PID 4456 wrote to memory of 3508 4456 AcGeecfc.exe svchost.exe PID 4456 wrote to memory of 3508 4456 AcGeecfc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe"C:\Users\Admin\AppData\Local\Temp\2be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C9DC\10.bat" "C:\Users\Admin\AppData\Roaming\Bingutil\AcGeecfc.exe" "C:\Users\Admin\AppData\Local\Temp\2BE8EA~1.EXE""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\Bingutil\AcGeecfc.exe" "C:\Users\Admin\AppData\Local\Temp\2BE8EA~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Bingutil\AcGeecfc.exe"C:\Users\Admin\AppData\Roaming\Bingutil\AcGeecfc.exe" "C:\Users\Admin\AppData\Local\Temp\2BE8EA~1.EXE"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 5685⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4456 -ip 44561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\C9DC\10.batFilesize
112B
MD5c8f86dcea7e1390889ce38d2b5abfc0f
SHA18771efd57cbf820ee2c8763bab31c868bed32142
SHA2565b185c091e3690815b579a67682c08342eeaad3b8e29daa9b3ee91bff44a7f22
SHA51222f4229f6d4d3721be9f3f085817a565c66ef59b231ab495cb73d6b63d511a0f8e34dac0002d1d60b6ae3c0e7c4098e1feb5c0d89560e91cf28a933ac7d73093
-
C:\Users\Admin\AppData\Roaming\Bingutil\AcGeecfc.exeFilesize
388KB
MD526cd3a038676f8e9cebf84a85dbe3668
SHA1feda5aa1052e306db3a6a73904ea6046b228abe8
SHA2562be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85
SHA51226b9b4e8f16e82aaea428d77afe92c0ab75cff6fb0bd848433b95e04b51f0da0799c0f48d1a4234ce15ccfa23b229860dda84f5155012bcf3955d0794cfb90ff
-
C:\Users\Admin\AppData\Roaming\Bingutil\AcGeecfc.exeFilesize
388KB
MD526cd3a038676f8e9cebf84a85dbe3668
SHA1feda5aa1052e306db3a6a73904ea6046b228abe8
SHA2562be8ea9bd232beaacec8ada47ef8a03adabffe69fead73517debc93a072f3b85
SHA51226b9b4e8f16e82aaea428d77afe92c0ab75cff6fb0bd848433b95e04b51f0da0799c0f48d1a4234ce15ccfa23b229860dda84f5155012bcf3955d0794cfb90ff
-
memory/1508-133-0x0000000000000000-mapping.dmp
-
memory/2760-135-0x0000000000000000-mapping.dmp
-
memory/4456-136-0x0000000000000000-mapping.dmp
-
memory/4456-139-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/4456-141-0x0000000002070000-0x00000000020A0000-memory.dmpFilesize
192KB
-
memory/4692-130-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/4692-132-0x0000000000610000-0x0000000000640000-memory.dmpFilesize
192KB