Analysis
-
max time kernel
76s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 03:57
Static task
static1
Behavioral task
behavioral1
Sample
5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe
Resource
win7-20220414-en
General
-
Target
5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe
-
Size
658KB
-
MD5
5cecd52c5f7a3a95392c2065e22a65ab
-
SHA1
295c122ecaa4239532320f0deff4aa94ed92e207
-
SHA256
5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4
-
SHA512
a064a5bbd139b8115b37463904126aeab354facfe99c46bb1aed0f8dffabd91a03fe190772b9253f57f5061a75506018c12dfa0bcabee5e957151287bc2385a0
Malware Config
Extracted
gozi_ifsb
1011
http://h33a7jzovxp2dxfg.onion
http://check.vivianmaierphotos.com
http://mysweetdream.site
http://marcoplfind.at
http://maildeliveryyboys1.at
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\bdesthci = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Bitsager\\Audiudrv.exe" Explorer.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.execontrol.exedescription pid process target process PID 1460 set thread context of 1100 1460 5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe control.exe PID 1100 set thread context of 1268 1100 control.exe Explorer.EXE PID 1100 set thread context of 1588 1100 control.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exeExplorer.EXEpid process 1460 5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe 1268 Explorer.EXE -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.execontrol.exepid process 1460 5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe 1100 control.exe 1100 control.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.execontrol.exedescription pid process target process PID 1460 wrote to memory of 1100 1460 5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe control.exe PID 1460 wrote to memory of 1100 1460 5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe control.exe PID 1460 wrote to memory of 1100 1460 5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe control.exe PID 1460 wrote to memory of 1100 1460 5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe control.exe PID 1460 wrote to memory of 1100 1460 5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe control.exe PID 1460 wrote to memory of 1100 1460 5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe control.exe PID 1460 wrote to memory of 1100 1460 5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe control.exe PID 1100 wrote to memory of 1268 1100 control.exe Explorer.EXE PID 1100 wrote to memory of 1268 1100 control.exe Explorer.EXE PID 1100 wrote to memory of 1268 1100 control.exe Explorer.EXE PID 1100 wrote to memory of 1588 1100 control.exe rundll32.exe PID 1100 wrote to memory of 1588 1100 control.exe rundll32.exe PID 1100 wrote to memory of 1588 1100 control.exe rundll32.exe PID 1100 wrote to memory of 1588 1100 control.exe rundll32.exe PID 1100 wrote to memory of 1588 1100 control.exe rundll32.exe PID 1100 wrote to memory of 1588 1100 control.exe rundll32.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe"C:\Users\Admin\AppData\Local\Temp\5f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\control.exeC:\Windows\system32\control.exe /?3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Bitsager\Audiudrv.exeFilesize
658KB
MD55cecd52c5f7a3a95392c2065e22a65ab
SHA1295c122ecaa4239532320f0deff4aa94ed92e207
SHA2565f01a4866431a17095c1b4b0eb6b6cd4ad221d4ff12bb2466280347abe3b13c4
SHA512a064a5bbd139b8115b37463904126aeab354facfe99c46bb1aed0f8dffabd91a03fe190772b9253f57f5061a75506018c12dfa0bcabee5e957151287bc2385a0
-
memory/1100-66-0x0000000000280000-0x0000000000331000-memory.dmpFilesize
708KB
-
memory/1100-65-0x0000000000000000-mapping.dmp
-
memory/1100-67-0x000007FEFC331000-0x000007FEFC333000-memory.dmpFilesize
8KB
-
memory/1100-72-0x0000000000280000-0x0000000000331000-memory.dmpFilesize
708KB
-
memory/1268-70-0x0000000004130000-0x00000000041E1000-memory.dmpFilesize
708KB
-
memory/1460-56-0x0000000000400000-0x00000000004D3000-memory.dmpFilesize
844KB
-
memory/1460-57-0x00000000769D1000-0x00000000769D3000-memory.dmpFilesize
8KB
-
memory/1460-58-0x0000000001DB0000-0x0000000001DFA000-memory.dmpFilesize
296KB
-
memory/1460-54-0x00000000005AD000-0x00000000005F8000-memory.dmpFilesize
300KB
-
memory/1460-55-0x00000000002E0000-0x0000000000329000-memory.dmpFilesize
292KB
-
memory/1588-68-0x0000000000000000-mapping.dmp
-
memory/1588-71-0x0000000001AD0000-0x0000000001B81000-memory.dmpFilesize
708KB