Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 06:02
Static task
static1
Behavioral task
behavioral1
Sample
86850bbf046bc1c9c33efe881effd67af0a753890e7c833cc52fe10b14a19607.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
86850bbf046bc1c9c33efe881effd67af0a753890e7c833cc52fe10b14a19607.dll
Resource
win10v2004-20220414-en
General
-
Target
86850bbf046bc1c9c33efe881effd67af0a753890e7c833cc52fe10b14a19607.dll
-
Size
1.2MB
-
MD5
61a6e9eb4e7fadde64147a6ff1a4859b
-
SHA1
65237daa32a2049b6cc09caa0080c9a089b639b7
-
SHA256
86850bbf046bc1c9c33efe881effd67af0a753890e7c833cc52fe10b14a19607
-
SHA512
dcb05784421123d1c7b7110446e932a5ac12dc98b0b27eb237b0694cf37e2af8d70a0e96ad9fc1e23a875e91d225316f2dd033ec94e7fb2ddcbc22de253db043
Malware Config
Extracted
gozi_ifsb
304
http://aaxvkah7dudzoloq.onion
http://tahhir.at
http://limpopo.at
http://estate-advice.at
-
build
217107
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Signatures
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\appmgcfg = "rundll32 \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Appimapi\\advptcls.dll\",DllRegisterServer" Explorer.EXE -
Suspicious use of SetThreadContext 4 IoCs
Processes:
rundll32.execontrol.exeExplorer.EXEdescription pid process target process PID 1824 set thread context of 1728 1824 rundll32.exe control.exe PID 1728 set thread context of 1368 1728 control.exe Explorer.EXE PID 1728 set thread context of 280 1728 control.exe rundll32.exe PID 1368 set thread context of 1904 1368 Explorer.EXE cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeExplorer.EXEpid process 1824 rundll32.exe 1368 Explorer.EXE -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
rundll32.execontrol.exeExplorer.EXEpid process 1824 rundll32.exe 1728 control.exe 1728 control.exe 1368 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
rundll32.exerundll32.execontrol.exeExplorer.EXEcmd.exedescription pid process target process PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1824 1980 rundll32.exe rundll32.exe PID 1824 wrote to memory of 1728 1824 rundll32.exe control.exe PID 1824 wrote to memory of 1728 1824 rundll32.exe control.exe PID 1824 wrote to memory of 1728 1824 rundll32.exe control.exe PID 1824 wrote to memory of 1728 1824 rundll32.exe control.exe PID 1824 wrote to memory of 1728 1824 rundll32.exe control.exe PID 1824 wrote to memory of 1728 1824 rundll32.exe control.exe PID 1824 wrote to memory of 1728 1824 rundll32.exe control.exe PID 1728 wrote to memory of 1368 1728 control.exe Explorer.EXE PID 1728 wrote to memory of 1368 1728 control.exe Explorer.EXE PID 1728 wrote to memory of 1368 1728 control.exe Explorer.EXE PID 1728 wrote to memory of 280 1728 control.exe rundll32.exe PID 1728 wrote to memory of 280 1728 control.exe rundll32.exe PID 1728 wrote to memory of 280 1728 control.exe rundll32.exe PID 1728 wrote to memory of 280 1728 control.exe rundll32.exe PID 1728 wrote to memory of 280 1728 control.exe rundll32.exe PID 1728 wrote to memory of 280 1728 control.exe rundll32.exe PID 1368 wrote to memory of 964 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 964 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 964 1368 Explorer.EXE cmd.exe PID 964 wrote to memory of 1220 964 cmd.exe nslookup.exe PID 964 wrote to memory of 1220 964 cmd.exe nslookup.exe PID 964 wrote to memory of 1220 964 cmd.exe nslookup.exe PID 1368 wrote to memory of 1236 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 1236 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 1236 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 1904 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 1904 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 1904 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 1904 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 1904 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 1904 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 1904 1368 Explorer.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\86850bbf046bc1c9c33efe881effd67af0a753890e7c833cc52fe10b14a19607.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\86850bbf046bc1c9c33efe881effd67af0a753890e7c833cc52fe10b14a19607.dll,#13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\control.exeC:\Windows\system32\control.exe /?4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?5⤵
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\E2E0.bi1"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E2E0.bi1"2⤵
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\E2E0.bi1Filesize
118B
MD54f6429322fdfd711b81d8824b25fcd9c
SHA1f7f917b64dd43b620bacd21f134d430d3c406aec
SHA256d22c844d015c874bbdbeb12b73ef54585cbd435c28f50d536fb4ace26d859ed8
SHA512e661f8d79b031a4a043a388ec17d82b5092859ac1d0ce6668a082feecf1da5665837ad1ef984751c7be174bbb6c1012f45d9f550d5cf65dc8b0e6cddcbdb0816
-
C:\Users\Admin\AppData\Local\Temp\E2E0.bi1Filesize
118B
MD54f6429322fdfd711b81d8824b25fcd9c
SHA1f7f917b64dd43b620bacd21f134d430d3c406aec
SHA256d22c844d015c874bbdbeb12b73ef54585cbd435c28f50d536fb4ace26d859ed8
SHA512e661f8d79b031a4a043a388ec17d82b5092859ac1d0ce6668a082feecf1da5665837ad1ef984751c7be174bbb6c1012f45d9f550d5cf65dc8b0e6cddcbdb0816
-
C:\Users\Admin\AppData\Roaming\Microsoft\Appimapi\advptcls.dllFilesize
1.2MB
MD561a6e9eb4e7fadde64147a6ff1a4859b
SHA165237daa32a2049b6cc09caa0080c9a089b639b7
SHA25686850bbf046bc1c9c33efe881effd67af0a753890e7c833cc52fe10b14a19607
SHA512dcb05784421123d1c7b7110446e932a5ac12dc98b0b27eb237b0694cf37e2af8d70a0e96ad9fc1e23a875e91d225316f2dd033ec94e7fb2ddcbc22de253db043
-
memory/280-72-0x0000000001AE0000-0x0000000001B93000-memory.dmpFilesize
716KB
-
memory/280-71-0x0000000000000000-mapping.dmp
-
memory/964-75-0x0000000000000000-mapping.dmp
-
memory/1220-76-0x0000000000000000-mapping.dmp
-
memory/1236-77-0x0000000000000000-mapping.dmp
-
memory/1368-74-0x0000000003F20000-0x0000000003FD3000-memory.dmpFilesize
716KB
-
memory/1728-68-0x0000000001AD0000-0x0000000001B83000-memory.dmpFilesize
716KB
-
memory/1728-69-0x000007FEFBFC1000-0x000007FEFBFC3000-memory.dmpFilesize
8KB
-
memory/1728-66-0x0000000000000000-mapping.dmp
-
memory/1728-73-0x0000000001AD0000-0x0000000001B83000-memory.dmpFilesize
716KB
-
memory/1824-59-0x00000000001A0000-0x00000000001EA000-memory.dmpFilesize
296KB
-
memory/1824-57-0x0000000010000000-0x000000001021D000-memory.dmpFilesize
2.1MB
-
memory/1824-54-0x0000000000000000-mapping.dmp
-
memory/1824-58-0x0000000010000000-0x000000001021D000-memory.dmpFilesize
2.1MB
-
memory/1824-67-0x0000000010000000-0x000000001021D000-memory.dmpFilesize
2.1MB
-
memory/1824-56-0x0000000010000000-0x000000001004C000-memory.dmpFilesize
304KB
-
memory/1824-55-0x00000000768D1000-0x00000000768D3000-memory.dmpFilesize
8KB
-
memory/1904-80-0x0000000000000000-mapping.dmp
-
memory/1904-81-0x00000000001F0000-0x0000000000295000-memory.dmpFilesize
660KB