Analysis

  • max time kernel
    50s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    16-06-2022 03:52

General

  • Target

    27a04637d9163782c1180141faeab903af0e45ec420da738c66770739be02217.exe

  • Size

    388KB

  • MD5

    6f53973fc74e45dfd268d788875213cd

  • SHA1

    8d9650b42290b5d41e15eea0d6a6ffac5f8ec6d7

  • SHA256

    27a04637d9163782c1180141faeab903af0e45ec420da738c66770739be02217

  • SHA512

    21b18db60020b449d211d9c233d04387be19f9b0730c1cb49f6d4e5f4c8ce5b92ca8e311b490731b78299add07dce0c80c7fe56341cf4072e2c1332076b812a5

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1010

C2

diuolirt.at

deopliazae.at

nifredao.com

filokiyurt.at

Attributes
  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1396
    • C:\Users\Admin\AppData\Local\Temp\27a04637d9163782c1180141faeab903af0e45ec420da738c66770739be02217.exe
      "C:\Users\Admin\AppData\Local\Temp\27a04637d9163782c1180141faeab903af0e45ec420da738c66770739be02217.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\9418\4A0C.bat" "C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\27A046~1.EXE""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1912
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C ""C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\27A046~1.EXE""
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1444
          • C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
            "C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\27A046~1.EXE"
            5⤵
            • Executes dropped EXE
            • Deletes itself
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1112
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2040

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9418\4A0C.bat

    Filesize

    108B

    MD5

    711f5bc160c81ce51b3111bbd9831ec6

    SHA1

    7b3df7761092b902aa19e77144d2409ace57e1ff

    SHA256

    0f2d3efbc7a309061f8c68e051c7424fc62135b3f1865db994ce1fa28e0e0dc7

    SHA512

    ea77305f7c1176eef45b20dc46634eb422599f63d512f40751e2325428617f0c0d5abc60cdab8b33afda85e1e5d6a58051d2bd9fa2c3e3ec958e420f0e935453

  • C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe

    Filesize

    388KB

    MD5

    6f53973fc74e45dfd268d788875213cd

    SHA1

    8d9650b42290b5d41e15eea0d6a6ffac5f8ec6d7

    SHA256

    27a04637d9163782c1180141faeab903af0e45ec420da738c66770739be02217

    SHA512

    21b18db60020b449d211d9c233d04387be19f9b0730c1cb49f6d4e5f4c8ce5b92ca8e311b490731b78299add07dce0c80c7fe56341cf4072e2c1332076b812a5

  • C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe

    Filesize

    388KB

    MD5

    6f53973fc74e45dfd268d788875213cd

    SHA1

    8d9650b42290b5d41e15eea0d6a6ffac5f8ec6d7

    SHA256

    27a04637d9163782c1180141faeab903af0e45ec420da738c66770739be02217

    SHA512

    21b18db60020b449d211d9c233d04387be19f9b0730c1cb49f6d4e5f4c8ce5b92ca8e311b490731b78299add07dce0c80c7fe56341cf4072e2c1332076b812a5

  • \Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe

    Filesize

    388KB

    MD5

    6f53973fc74e45dfd268d788875213cd

    SHA1

    8d9650b42290b5d41e15eea0d6a6ffac5f8ec6d7

    SHA256

    27a04637d9163782c1180141faeab903af0e45ec420da738c66770739be02217

    SHA512

    21b18db60020b449d211d9c233d04387be19f9b0730c1cb49f6d4e5f4c8ce5b92ca8e311b490731b78299add07dce0c80c7fe56341cf4072e2c1332076b812a5

  • \Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe

    Filesize

    388KB

    MD5

    6f53973fc74e45dfd268d788875213cd

    SHA1

    8d9650b42290b5d41e15eea0d6a6ffac5f8ec6d7

    SHA256

    27a04637d9163782c1180141faeab903af0e45ec420da738c66770739be02217

    SHA512

    21b18db60020b449d211d9c233d04387be19f9b0730c1cb49f6d4e5f4c8ce5b92ca8e311b490731b78299add07dce0c80c7fe56341cf4072e2c1332076b812a5

  • memory/1112-64-0x0000000000000000-mapping.dmp

  • memory/1112-67-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/1112-69-0x0000000000220000-0x0000000000250000-memory.dmp

    Filesize

    192KB

  • memory/1120-55-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/1120-57-0x00000000002A0000-0x00000000002D0000-memory.dmp

    Filesize

    192KB

  • memory/1120-54-0x00000000759E1000-0x00000000759E3000-memory.dmp

    Filesize

    8KB

  • memory/1396-73-0x0000000002620000-0x0000000002695000-memory.dmp

    Filesize

    468KB

  • memory/1396-74-0x0000000002620000-0x0000000002695000-memory.dmp

    Filesize

    468KB

  • memory/1444-60-0x0000000000000000-mapping.dmp

  • memory/1912-58-0x0000000000000000-mapping.dmp

  • memory/2040-71-0x0000000000410000-0x0000000000485000-memory.dmp

    Filesize

    468KB

  • memory/2040-72-0x0000000000410000-0x0000000000485000-memory.dmp

    Filesize

    468KB

  • memory/2040-70-0x0000000000000000-mapping.dmp