Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    08-07-2022 09:16

General

  • Target

    238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe

  • Size

    908KB

  • MD5

    17dd353ddd444e821e3bf2223e9c0ac8

  • SHA1

    0caca653add90b677510763b18bbecf99c44c744

  • SHA256

    238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24

  • SHA512

    ef8ddb6a6d01f96c6a0c9875b968e50cbd61b84e1ba065b698408298200789125882ff81489e3f8e849d5d21c2c2c1bd00b3f3705a2468e647365fbc3e9109e7

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300854

  • exe_type

    loader

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes
  • build

    300854

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD3AfU4ayUEHchQ3H0W1/d3ziW
3
VNCFHWaAm8mJq6hQwn03GNGV7hOICH8h/+dZGEwYWVnRq128QMPZTIj0b+iqHKlM
4
sHzxEIZlWUVvnfbx6unDAC8aJXovmePrPvbHJ1FrplzlbILiPLvofh7pXzTdfcDQ
5
e3wfV7cbxJ3DXessqwIDAQAB
6
-----END PUBLIC KEY-----
serpent.plain
1
8JbpEEfNYPlYoAN4

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
    "C:\Users\Admin\AppData\Local\Temp\238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe"
    1⤵
      PID:4504
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:2636
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4852
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4852 CREDAT:17410 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:332
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4852 CREDAT:17416 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:3620
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4736
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4736 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4668
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4752
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4752 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4776
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4648
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2136
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1820
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2992
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1764

      Network

      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • flag-us
        DNS
        devicelease.xyz
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        Remote address:
        8.8.8.8:53
        Request
        devicelease.xyz
        IN A
        Response
      • 52.109.76.30:443
        40 B
        1
      • 67.27.154.126:80
        322 B
        7
      • 20.42.65.89:443
        322 B
        7
      • 67.27.154.126:80
        322 B
        7
      • 67.27.154.126:80
        322 B
        7
      • 67.27.154.126:80
        322 B
        7
      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        61 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      • 8.8.8.8:53
        devicelease.xyz
        dns
        238bfb7a08c1fe12ebdaeb8e61598df76ef9e6afc8d626395fe4c40473741b24.exe
        61 B
        126 B
        1
        1

        DNS Request

        devicelease.xyz

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4504-130-0x0000000002240000-0x0000000002251000-memory.dmp

        Filesize

        68KB

      • memory/4504-136-0x0000000002220000-0x000000000222C000-memory.dmp

        Filesize

        48KB

      • memory/4504-137-0x0000000000400000-0x00000000004E5000-memory.dmp

        Filesize

        916KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.