Analysis
-
max time kernel
152s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 05:10
Static task
static1
Behavioral task
behavioral1
Sample
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe
Resource
win7-20220414-en
General
-
Target
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe
-
Size
252KB
-
MD5
652a4de0918a9de8a3fc0bc472f7a86d
-
SHA1
a979fe13938cf0c7b29f97def7b4e4b0aa0e8547
-
SHA256
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b
-
SHA512
af0a9e44576586372e1bd0e78a0d0de98a4c53ade727056589ed662b8d108633da6a195186296abec2ff8d11b9f50e742af1298817e0e2f365a68835ab3809f1
Malware Config
Extracted
gozi_ifsb
1020
base.oldirtybastardlegacyfundraiser.us/htue503dt
base.happytroutproductions.com/htue503dt
base.makealivingteachingonline.com/htue503dt
base.convertspendingtocash.com/htue503dt
executenet.pw/htue503dt
-
build
214745
-
exe_type
worker
-
server_id
60
Signatures
-
suricata: ET MALWARE Ursnif Variant CnC Beacon
suricata: ET MALWARE Ursnif Variant CnC Beacon
-
Executes dropped EXE 2 IoCs
Processes:
apprispl.exeapprispl.exepid process 4396 apprispl.exe 4976 apprispl.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\capigSup = "C:\\Users\\Admin\\AppData\\Roaming\\Azurives\\apprispl.exe" 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exeapprispl.exeapprispl.exesvchost.exeExplorer.EXEdescription pid process target process PID 2964 set thread context of 4208 2964 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 4396 set thread context of 4976 4396 apprispl.exe apprispl.exe PID 4976 set thread context of 1628 4976 apprispl.exe svchost.exe PID 1628 set thread context of 3152 1628 svchost.exe Explorer.EXE PID 3152 set thread context of 3632 3152 Explorer.EXE RuntimeBroker.exe PID 3152 set thread context of 3912 3152 Explorer.EXE RuntimeBroker.exe PID 3152 set thread context of 4584 3152 Explorer.EXE RuntimeBroker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
apprispl.exeExplorer.EXEpid process 4976 apprispl.exe 4976 apprispl.exe 3152 Explorer.EXE 3152 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3152 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
apprispl.exesvchost.exeExplorer.EXEpid process 4976 apprispl.exe 1628 svchost.exe 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RuntimeBroker.exedescription pid process Token: SeShutdownPrivilege 3632 RuntimeBroker.exe Token: SeShutdownPrivilege 3632 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3152 Explorer.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.execmd.execmd.exeapprispl.exeapprispl.exesvchost.exeExplorer.EXEdescription pid process target process PID 2964 wrote to memory of 4208 2964 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 2964 wrote to memory of 4208 2964 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 2964 wrote to memory of 4208 2964 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 2964 wrote to memory of 4208 2964 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 2964 wrote to memory of 4208 2964 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 2964 wrote to memory of 4208 2964 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 2964 wrote to memory of 4208 2964 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 2964 wrote to memory of 4208 2964 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 2964 wrote to memory of 4208 2964 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 2964 wrote to memory of 4208 2964 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe PID 4208 wrote to memory of 2052 4208 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe cmd.exe PID 4208 wrote to memory of 2052 4208 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe cmd.exe PID 4208 wrote to memory of 2052 4208 3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe cmd.exe PID 2052 wrote to memory of 4796 2052 cmd.exe cmd.exe PID 2052 wrote to memory of 4796 2052 cmd.exe cmd.exe PID 2052 wrote to memory of 4796 2052 cmd.exe cmd.exe PID 4796 wrote to memory of 4396 4796 cmd.exe apprispl.exe PID 4796 wrote to memory of 4396 4796 cmd.exe apprispl.exe PID 4796 wrote to memory of 4396 4796 cmd.exe apprispl.exe PID 4396 wrote to memory of 4976 4396 apprispl.exe apprispl.exe PID 4396 wrote to memory of 4976 4396 apprispl.exe apprispl.exe PID 4396 wrote to memory of 4976 4396 apprispl.exe apprispl.exe PID 4396 wrote to memory of 4976 4396 apprispl.exe apprispl.exe PID 4396 wrote to memory of 4976 4396 apprispl.exe apprispl.exe PID 4396 wrote to memory of 4976 4396 apprispl.exe apprispl.exe PID 4396 wrote to memory of 4976 4396 apprispl.exe apprispl.exe PID 4396 wrote to memory of 4976 4396 apprispl.exe apprispl.exe PID 4396 wrote to memory of 4976 4396 apprispl.exe apprispl.exe PID 4396 wrote to memory of 4976 4396 apprispl.exe apprispl.exe PID 4976 wrote to memory of 1628 4976 apprispl.exe svchost.exe PID 4976 wrote to memory of 1628 4976 apprispl.exe svchost.exe PID 4976 wrote to memory of 1628 4976 apprispl.exe svchost.exe PID 4976 wrote to memory of 1628 4976 apprispl.exe svchost.exe PID 4976 wrote to memory of 1628 4976 apprispl.exe svchost.exe PID 1628 wrote to memory of 3152 1628 svchost.exe Explorer.EXE PID 1628 wrote to memory of 3152 1628 svchost.exe Explorer.EXE PID 1628 wrote to memory of 3152 1628 svchost.exe Explorer.EXE PID 3152 wrote to memory of 3632 3152 Explorer.EXE RuntimeBroker.exe PID 3152 wrote to memory of 3632 3152 Explorer.EXE RuntimeBroker.exe PID 3152 wrote to memory of 3632 3152 Explorer.EXE RuntimeBroker.exe PID 3152 wrote to memory of 3912 3152 Explorer.EXE RuntimeBroker.exe PID 3152 wrote to memory of 3912 3152 Explorer.EXE RuntimeBroker.exe PID 3152 wrote to memory of 3912 3152 Explorer.EXE RuntimeBroker.exe PID 3152 wrote to memory of 4584 3152 Explorer.EXE RuntimeBroker.exe PID 3152 wrote to memory of 4584 3152 Explorer.EXE RuntimeBroker.exe PID 3152 wrote to memory of 4584 3152 Explorer.EXE RuntimeBroker.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe"C:\Users\Admin\AppData\Local\Temp\3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe"C:\Users\Admin\AppData\Local\Temp\3cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b.exe"3⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A80\2E.bat" "C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exe" "C:\Users\Admin\AppData\Local\Temp\3CD57E~1.EXE""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exe" "C:\Users\Admin\AppData\Local\Temp\3CD57E~1.EXE""5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exe"C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exe" "C:\Users\Admin\AppData\Local\Temp\3CD57E~1.EXE"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exe"C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\A80\2E.batFilesize
112B
MD59e23e8d7388237854a58b4f61c80f4bf
SHA1aca12a1ef194fd9422f3e39446068709d7ddc129
SHA256b3a8b5ecb82311f8dd11ffd3564a6dfc089089f4099d7fe83f3b8dcc5e115a5a
SHA512c2365369c2bd30e36c67f32c1f8b8f86716e04cb315e3f49bedfe02c9bc11d8a4f7172ff52f9fca712e4e7bc36353eed7d605f504288a20c060af2849be99237
-
C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exeFilesize
252KB
MD5652a4de0918a9de8a3fc0bc472f7a86d
SHA1a979fe13938cf0c7b29f97def7b4e4b0aa0e8547
SHA2563cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b
SHA512af0a9e44576586372e1bd0e78a0d0de98a4c53ade727056589ed662b8d108633da6a195186296abec2ff8d11b9f50e742af1298817e0e2f365a68835ab3809f1
-
C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exeFilesize
252KB
MD5652a4de0918a9de8a3fc0bc472f7a86d
SHA1a979fe13938cf0c7b29f97def7b4e4b0aa0e8547
SHA2563cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b
SHA512af0a9e44576586372e1bd0e78a0d0de98a4c53ade727056589ed662b8d108633da6a195186296abec2ff8d11b9f50e742af1298817e0e2f365a68835ab3809f1
-
C:\Users\Admin\AppData\Roaming\Azurives\apprispl.exeFilesize
252KB
MD5652a4de0918a9de8a3fc0bc472f7a86d
SHA1a979fe13938cf0c7b29f97def7b4e4b0aa0e8547
SHA2563cd57e714aa0b542686ac077089b6b2d82235f5974ffd6632923e9a2c9ae271b
SHA512af0a9e44576586372e1bd0e78a0d0de98a4c53ade727056589ed662b8d108633da6a195186296abec2ff8d11b9f50e742af1298817e0e2f365a68835ab3809f1
-
memory/1628-153-0x0000000000000000-mapping.dmp
-
memory/1628-155-0x0000000000920000-0x00000000009AC000-memory.dmpFilesize
560KB
-
memory/2052-138-0x0000000000000000-mapping.dmp
-
memory/2964-130-0x0000000074930000-0x0000000074EE1000-memory.dmpFilesize
5.7MB
-
memory/2964-136-0x0000000074930000-0x0000000074EE1000-memory.dmpFilesize
5.7MB
-
memory/2964-131-0x0000000074930000-0x0000000074EE1000-memory.dmpFilesize
5.7MB
-
memory/3152-156-0x0000000002730000-0x00000000027BC000-memory.dmpFilesize
560KB
-
memory/3632-157-0x00000220D4490000-0x00000220D451C000-memory.dmpFilesize
560KB
-
memory/3912-158-0x000001E7E5010000-0x000001E7E509C000-memory.dmpFilesize
560KB
-
memory/4208-137-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4208-135-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4208-133-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4208-132-0x0000000000000000-mapping.dmp
-
memory/4396-145-0x0000000074920000-0x0000000074ED1000-memory.dmpFilesize
5.7MB
-
memory/4396-144-0x0000000074920000-0x0000000074ED1000-memory.dmpFilesize
5.7MB
-
memory/4396-152-0x0000000074920000-0x0000000074ED1000-memory.dmpFilesize
5.7MB
-
memory/4396-141-0x0000000000000000-mapping.dmp
-
memory/4584-159-0x000001959E940000-0x000001959E9CC000-memory.dmpFilesize
560KB
-
memory/4796-140-0x0000000000000000-mapping.dmp
-
memory/4976-146-0x0000000000000000-mapping.dmp
-
memory/4976-151-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4976-154-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB