Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 08:38
Static task
static1
Behavioral task
behavioral1
Sample
3c181213b4ce99bf4329a9bf6c880199ef971531f164c0f2e570ab3b0e7d5304.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3c181213b4ce99bf4329a9bf6c880199ef971531f164c0f2e570ab3b0e7d5304.dll
Resource
win10v2004-20220414-en
General
-
Target
3c181213b4ce99bf4329a9bf6c880199ef971531f164c0f2e570ab3b0e7d5304.dll
-
Size
1.1MB
-
MD5
b91e58d4b7dbf84c497a25dceca80366
-
SHA1
d13c7920c28a9dc2677b238f1ad5b2d6526a16c5
-
SHA256
3c181213b4ce99bf4329a9bf6c880199ef971531f164c0f2e570ab3b0e7d5304
-
SHA512
dce948f35a4e065f48fe30a58185ba32b1d00029f55306cab9a0fbc5f5f0c0a2a677c035f6e31bd499e1f905d88b1fcb40dbdb70745b1832ae9e5f0f36a89473
Malware Config
Extracted
gozi_ifsb
1000
http://ey7kuuklgieop2pq.onion
http://shoshanna.at
http://buismashallah.at
-
build
217027
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Signatures
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Appvvel9 = "rundll32 \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Asfeynth\\APHoFWGP.dll\",DllRegisterServer" Explorer.EXE -
Suspicious use of SetThreadContext 8 IoCs
Processes:
rundll32.execontrol.exeExplorer.EXEdescription pid process target process PID 776 set thread context of 548 776 rundll32.exe control.exe PID 548 set thread context of 1504 548 control.exe Explorer.EXE PID 1504 set thread context of 3528 1504 Explorer.EXE RuntimeBroker.exe PID 1504 set thread context of 3824 1504 Explorer.EXE RuntimeBroker.exe PID 1504 set thread context of 2612 1504 Explorer.EXE RuntimeBroker.exe PID 548 set thread context of 3968 548 control.exe rundll32.exe PID 1504 set thread context of 2592 1504 Explorer.EXE RuntimeBroker.exe PID 1504 set thread context of 3780 1504 Explorer.EXE cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exeExplorer.EXEpid process 776 rundll32.exe 776 rundll32.exe 1504 Explorer.EXE 1504 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1504 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
rundll32.execontrol.exeExplorer.EXEpid process 776 rundll32.exe 548 control.exe 1504 Explorer.EXE 1504 Explorer.EXE 1504 Explorer.EXE 548 control.exe 1504 Explorer.EXE 1504 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 1504 Explorer.EXE Token: SeCreatePagefilePrivilege 1504 Explorer.EXE Token: SeShutdownPrivilege 1504 Explorer.EXE Token: SeCreatePagefilePrivilege 1504 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1504 Explorer.EXE -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
rundll32.exerundll32.execontrol.exeExplorer.EXEcmd.exedescription pid process target process PID 4256 wrote to memory of 776 4256 rundll32.exe rundll32.exe PID 4256 wrote to memory of 776 4256 rundll32.exe rundll32.exe PID 4256 wrote to memory of 776 4256 rundll32.exe rundll32.exe PID 776 wrote to memory of 548 776 rundll32.exe control.exe PID 776 wrote to memory of 548 776 rundll32.exe control.exe PID 776 wrote to memory of 548 776 rundll32.exe control.exe PID 776 wrote to memory of 548 776 rundll32.exe control.exe PID 776 wrote to memory of 548 776 rundll32.exe control.exe PID 548 wrote to memory of 1504 548 control.exe Explorer.EXE PID 548 wrote to memory of 1504 548 control.exe Explorer.EXE PID 548 wrote to memory of 1504 548 control.exe Explorer.EXE PID 1504 wrote to memory of 3528 1504 Explorer.EXE RuntimeBroker.exe PID 1504 wrote to memory of 3528 1504 Explorer.EXE RuntimeBroker.exe PID 1504 wrote to memory of 3528 1504 Explorer.EXE RuntimeBroker.exe PID 1504 wrote to memory of 3824 1504 Explorer.EXE RuntimeBroker.exe PID 548 wrote to memory of 3968 548 control.exe rundll32.exe PID 548 wrote to memory of 3968 548 control.exe rundll32.exe PID 548 wrote to memory of 3968 548 control.exe rundll32.exe PID 1504 wrote to memory of 3824 1504 Explorer.EXE RuntimeBroker.exe PID 1504 wrote to memory of 3824 1504 Explorer.EXE RuntimeBroker.exe PID 1504 wrote to memory of 2612 1504 Explorer.EXE RuntimeBroker.exe PID 1504 wrote to memory of 2612 1504 Explorer.EXE RuntimeBroker.exe PID 1504 wrote to memory of 2612 1504 Explorer.EXE RuntimeBroker.exe PID 1504 wrote to memory of 2592 1504 Explorer.EXE RuntimeBroker.exe PID 548 wrote to memory of 3968 548 control.exe rundll32.exe PID 548 wrote to memory of 3968 548 control.exe rundll32.exe PID 1504 wrote to memory of 2592 1504 Explorer.EXE RuntimeBroker.exe PID 1504 wrote to memory of 2592 1504 Explorer.EXE RuntimeBroker.exe PID 1504 wrote to memory of 2324 1504 Explorer.EXE cmd.exe PID 1504 wrote to memory of 2324 1504 Explorer.EXE cmd.exe PID 2324 wrote to memory of 2232 2324 cmd.exe nslookup.exe PID 2324 wrote to memory of 2232 2324 cmd.exe nslookup.exe PID 1504 wrote to memory of 2928 1504 Explorer.EXE cmd.exe PID 1504 wrote to memory of 2928 1504 Explorer.EXE cmd.exe PID 1504 wrote to memory of 3780 1504 Explorer.EXE cmd.exe PID 1504 wrote to memory of 3780 1504 Explorer.EXE cmd.exe PID 1504 wrote to memory of 3780 1504 Explorer.EXE cmd.exe PID 1504 wrote to memory of 3780 1504 Explorer.EXE cmd.exe PID 1504 wrote to memory of 3780 1504 Explorer.EXE cmd.exe PID 1504 wrote to memory of 3780 1504 Explorer.EXE cmd.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c181213b4ce99bf4329a9bf6c880199ef971531f164c0f2e570ab3b0e7d5304.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c181213b4ce99bf4329a9bf6c880199ef971531f164c0f2e570ab3b0e7d5304.dll,#13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\control.exeC:\Windows\system32\control.exe /?4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?5⤵
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\6138.bi1"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\6138.bi1"2⤵
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6138.bi1Filesize
118B
MD54f6429322fdfd711b81d8824b25fcd9c
SHA1f7f917b64dd43b620bacd21f134d430d3c406aec
SHA256d22c844d015c874bbdbeb12b73ef54585cbd435c28f50d536fb4ace26d859ed8
SHA512e661f8d79b031a4a043a388ec17d82b5092859ac1d0ce6668a082feecf1da5665837ad1ef984751c7be174bbb6c1012f45d9f550d5cf65dc8b0e6cddcbdb0816
-
C:\Users\Admin\AppData\Local\Temp\6138.bi1Filesize
118B
MD54f6429322fdfd711b81d8824b25fcd9c
SHA1f7f917b64dd43b620bacd21f134d430d3c406aec
SHA256d22c844d015c874bbdbeb12b73ef54585cbd435c28f50d536fb4ace26d859ed8
SHA512e661f8d79b031a4a043a388ec17d82b5092859ac1d0ce6668a082feecf1da5665837ad1ef984751c7be174bbb6c1012f45d9f550d5cf65dc8b0e6cddcbdb0816
-
C:\Users\Admin\AppData\Roaming\Microsoft\Asfeynth\APHoFWGP.dllFilesize
1.1MB
MD5b91e58d4b7dbf84c497a25dceca80366
SHA1d13c7920c28a9dc2677b238f1ad5b2d6526a16c5
SHA2563c181213b4ce99bf4329a9bf6c880199ef971531f164c0f2e570ab3b0e7d5304
SHA512dce948f35a4e065f48fe30a58185ba32b1d00029f55306cab9a0fbc5f5f0c0a2a677c035f6e31bd499e1f905d88b1fcb40dbdb70745b1832ae9e5f0f36a89473
-
memory/548-146-0x0000000000000000-mapping.dmp
-
memory/548-151-0x0000000000780000-0x0000000000831000-memory.dmpFilesize
708KB
-
memory/776-138-0x00000000028B0000-0x00000000028FA000-memory.dmpFilesize
296KB
-
memory/776-136-0x0000000001E90000-0x00000000028AB000-memory.dmpFilesize
10.1MB
-
memory/776-130-0x0000000000000000-mapping.dmp
-
memory/776-145-0x0000000001E90000-0x00000000028AB000-memory.dmpFilesize
10.1MB
-
memory/776-137-0x0000000001E90000-0x00000000028AB000-memory.dmpFilesize
10.1MB
-
memory/776-147-0x0000000001E90000-0x00000000028AB000-memory.dmpFilesize
10.1MB
-
memory/776-135-0x0000000001E91000-0x0000000001F48000-memory.dmpFilesize
732KB
-
memory/776-131-0x0000000001E90000-0x00000000028AB000-memory.dmpFilesize
10.1MB
-
memory/776-133-0x0000000001E90000-0x00000000028AB000-memory.dmpFilesize
10.1MB
-
memory/776-134-0x0000000001E90000-0x0000000001EDB000-memory.dmpFilesize
300KB
-
memory/1504-152-0x0000000007C90000-0x0000000007D41000-memory.dmpFilesize
708KB
-
memory/2232-158-0x0000000000000000-mapping.dmp
-
memory/2324-157-0x0000000000000000-mapping.dmp
-
memory/2592-156-0x00000199E6310000-0x00000199E63C1000-memory.dmpFilesize
708KB
-
memory/2612-155-0x000001A7CE830000-0x000001A7CE8E1000-memory.dmpFilesize
708KB
-
memory/2928-159-0x0000000000000000-mapping.dmp
-
memory/3528-153-0x000001E5721F0000-0x000001E5722A1000-memory.dmpFilesize
708KB
-
memory/3780-162-0x0000000000000000-mapping.dmp
-
memory/3780-163-0x0000000000DE6B20-0x0000000000DE6B24-memory.dmpFilesize
4B
-
memory/3780-164-0x00000000016F0000-0x0000000001794000-memory.dmpFilesize
656KB
-
memory/3824-154-0x000001B8D6510000-0x000001B8D65C1000-memory.dmpFilesize
708KB
-
memory/3968-150-0x000002345DEC0000-0x000002345DF71000-memory.dmpFilesize
708KB
-
memory/3968-149-0x0000000000000000-mapping.dmp