Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 05:10
Static task
static1
Behavioral task
behavioral1
Sample
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe
Resource
win7-20220414-en
General
-
Target
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe
-
Size
252KB
-
MD5
652a4de0918a9de8a3fc0bc472f7a86d
-
SHA1
a979fe13938cf0c7b29f97def7b4e4b0aa0e8547
-
SHA256
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b
-
SHA512
af0a9e44576586372e1bd0e78a0d0de98a4c53ade727056589ed662b8d108633da6a195186296abec2ff8d11b9f50e742af1298817e0e2f365a68835ab3809f1
Malware Config
Extracted
gozi_ifsb
-
build
214745
Extracted
gozi_ifsb
1020
base.oldirtybastardlegacyfundraiser.us/htue503dt
base.happytroutproductions.com/htue503dt
base.makealivingteachingonline.com/htue503dt
base.convertspendingtocash.com/htue503dt
executenet.pw/htue503dt
-
build
214745
-
exe_type
worker
-
server_id
60
Signatures
-
suricata: ET MALWARE Ursnif Variant CnC Beacon
suricata: ET MALWARE Ursnif Variant CnC Beacon
-
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
-
Executes dropped EXE 2 IoCs
Processes:
ACCTient.exeACCTient.exepid process 1708 ACCTient.exe 596 ACCTient.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1976 cmd.exe 1976 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audiedit = "C:\\Users\\Admin\\AppData\\Roaming\\bitsmuid\\ACCTient.exe" 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exeACCTient.exeACCTient.exesvchost.exedescription pid process target process PID 1704 set thread context of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 1708 set thread context of 596 1708 ACCTient.exe ACCTient.exe PID 596 set thread context of 516 596 ACCTient.exe svchost.exe PID 516 set thread context of 1260 516 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ACCTient.exeExplorer.EXEpid process 596 ACCTient.exe 1260 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
ACCTient.exesvchost.exepid process 596 ACCTient.exe 516 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.execmd.execmd.exeACCTient.exeACCTient.exesvchost.exedescription pid process target process PID 1704 wrote to memory of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 1704 wrote to memory of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 1704 wrote to memory of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 1704 wrote to memory of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 1704 wrote to memory of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 1704 wrote to memory of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 1704 wrote to memory of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 1704 wrote to memory of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 1704 wrote to memory of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 1704 wrote to memory of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 1704 wrote to memory of 2044 1704 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 2044 wrote to memory of 888 2044 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe cmd.exe PID 2044 wrote to memory of 888 2044 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe cmd.exe PID 2044 wrote to memory of 888 2044 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe cmd.exe PID 2044 wrote to memory of 888 2044 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe cmd.exe PID 888 wrote to memory of 1976 888 cmd.exe cmd.exe PID 888 wrote to memory of 1976 888 cmd.exe cmd.exe PID 888 wrote to memory of 1976 888 cmd.exe cmd.exe PID 888 wrote to memory of 1976 888 cmd.exe cmd.exe PID 1976 wrote to memory of 1708 1976 cmd.exe ACCTient.exe PID 1976 wrote to memory of 1708 1976 cmd.exe ACCTient.exe PID 1976 wrote to memory of 1708 1976 cmd.exe ACCTient.exe PID 1976 wrote to memory of 1708 1976 cmd.exe ACCTient.exe PID 1708 wrote to memory of 596 1708 ACCTient.exe ACCTient.exe PID 1708 wrote to memory of 596 1708 ACCTient.exe ACCTient.exe PID 1708 wrote to memory of 596 1708 ACCTient.exe ACCTient.exe PID 1708 wrote to memory of 596 1708 ACCTient.exe ACCTient.exe PID 1708 wrote to memory of 596 1708 ACCTient.exe ACCTient.exe PID 1708 wrote to memory of 596 1708 ACCTient.exe ACCTient.exe PID 1708 wrote to memory of 596 1708 ACCTient.exe ACCTient.exe PID 1708 wrote to memory of 596 1708 ACCTient.exe ACCTient.exe PID 1708 wrote to memory of 596 1708 ACCTient.exe ACCTient.exe PID 1708 wrote to memory of 596 1708 ACCTient.exe ACCTient.exe PID 1708 wrote to memory of 596 1708 ACCTient.exe ACCTient.exe PID 596 wrote to memory of 516 596 ACCTient.exe svchost.exe PID 596 wrote to memory of 516 596 ACCTient.exe svchost.exe PID 596 wrote to memory of 516 596 ACCTient.exe svchost.exe PID 596 wrote to memory of 516 596 ACCTient.exe svchost.exe PID 596 wrote to memory of 516 596 ACCTient.exe svchost.exe PID 596 wrote to memory of 516 596 ACCTient.exe svchost.exe PID 596 wrote to memory of 516 596 ACCTient.exe svchost.exe PID 516 wrote to memory of 1260 516 svchost.exe Explorer.EXE PID 516 wrote to memory of 1260 516 svchost.exe Explorer.EXE PID 516 wrote to memory of 1260 516 svchost.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe"C:\Users\Admin\AppData\Local\Temp\3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe"C:\Users\Admin\AppData\Local\Temp\3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe"3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\DD08\47.bat" "C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\3CD57E~1.EXE""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\3CD57E~1.EXE""5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe"C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\3CD57E~1.EXE"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe"C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DD08\47.batFilesize
108B
MD5a29a8a01dcbb5d3fb51ab782f8777290
SHA1911295e39862f875d78571ddc736d04fe103dd19
SHA2560b02846269c2667d9e53c459368af28a3dbef64a6d4bf63e9b291655e31607c6
SHA51200c04056a0fe32ede3efaf39d9b46159585c6d261721a656007379d31a7b22fd4b1623d642000b7c4b9c4a0ea4e67b6bc9be1829032f90ed233006e64f26a6b9
-
C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exeFilesize
252KB
MD5652a4de0918a9de8a3fc0bc472f7a86d
SHA1a979fe13938cf0c7b29f97def7b4e4b0aa0e8547
SHA2563cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b
SHA512af0a9e44576586372e1bd0e78a0d0de98a4c53ade727056589ed662b8d108633da6a195186296abec2ff8d11b9f50e742af1298817e0e2f365a68835ab3809f1
-
C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exeFilesize
252KB
MD5652a4de0918a9de8a3fc0bc472f7a86d
SHA1a979fe13938cf0c7b29f97def7b4e4b0aa0e8547
SHA2563cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b
SHA512af0a9e44576586372e1bd0e78a0d0de98a4c53ade727056589ed662b8d108633da6a195186296abec2ff8d11b9f50e742af1298817e0e2f365a68835ab3809f1
-
C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exeFilesize
252KB
MD5652a4de0918a9de8a3fc0bc472f7a86d
SHA1a979fe13938cf0c7b29f97def7b4e4b0aa0e8547
SHA2563cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b
SHA512af0a9e44576586372e1bd0e78a0d0de98a4c53ade727056589ed662b8d108633da6a195186296abec2ff8d11b9f50e742af1298817e0e2f365a68835ab3809f1
-
\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exeFilesize
252KB
MD5652a4de0918a9de8a3fc0bc472f7a86d
SHA1a979fe13938cf0c7b29f97def7b4e4b0aa0e8547
SHA2563cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b
SHA512af0a9e44576586372e1bd0e78a0d0de98a4c53ade727056589ed662b8d108633da6a195186296abec2ff8d11b9f50e742af1298817e0e2f365a68835ab3809f1
-
\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exeFilesize
252KB
MD5652a4de0918a9de8a3fc0bc472f7a86d
SHA1a979fe13938cf0c7b29f97def7b4e4b0aa0e8547
SHA2563cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b
SHA512af0a9e44576586372e1bd0e78a0d0de98a4c53ade727056589ed662b8d108633da6a195186296abec2ff8d11b9f50e742af1298817e0e2f365a68835ab3809f1
-
memory/516-102-0x00000000003C0000-0x000000000044C000-memory.dmpFilesize
560KB
-
memory/516-98-0x0000000000000000-mapping.dmp
-
memory/516-101-0x00000000003C0000-0x000000000044C000-memory.dmpFilesize
560KB
-
memory/596-99-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/596-100-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/596-92-0x0000000000401000-mapping.dmp
-
memory/888-72-0x0000000000000000-mapping.dmp
-
memory/1260-103-0x00000000039D0000-0x0000000003A5C000-memory.dmpFilesize
560KB
-
memory/1260-104-0x00000000039D0000-0x0000000003A5C000-memory.dmpFilesize
560KB
-
memory/1704-56-0x0000000074520000-0x0000000074ACB000-memory.dmpFilesize
5.7MB
-
memory/1704-54-0x00000000755B1000-0x00000000755B3000-memory.dmpFilesize
8KB
-
memory/1704-70-0x0000000074520000-0x0000000074ACB000-memory.dmpFilesize
5.7MB
-
memory/1704-55-0x0000000074520000-0x0000000074ACB000-memory.dmpFilesize
5.7MB
-
memory/1708-82-0x0000000073F70000-0x000000007451B000-memory.dmpFilesize
5.7MB
-
memory/1708-96-0x0000000073F70000-0x000000007451B000-memory.dmpFilesize
5.7MB
-
memory/1708-78-0x0000000000000000-mapping.dmp
-
memory/1708-81-0x0000000073F70000-0x000000007451B000-memory.dmpFilesize
5.7MB
-
memory/1976-74-0x0000000000000000-mapping.dmp
-
memory/2044-71-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2044-69-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2044-66-0x0000000000401000-mapping.dmp
-
memory/2044-65-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2044-63-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2044-62-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2044-61-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2044-60-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2044-58-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2044-57-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB