Analysis
-
max time kernel
52s -
max time network
74s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2022 17:52
Static task
static1
Behavioral task
behavioral1
Sample
511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exe
Resource
win10v2004-20220718-en
General
-
Target
511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exe
-
Size
388KB
-
MD5
3474be0fade46da14a1875ed0ab1367b
-
SHA1
771fec73856533568dc757c719389142109ce3c4
-
SHA256
511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be
-
SHA512
142e88d130552cf0ad4dfbaac394a56ecfc5bf2e07f4137db4323894310d4c215d70b1e9712d45b840e13e56d69c007e93b1018f24ba003794857123f95e3b94
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
batmedui.exepid process 3532 batmedui.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\Control Panel\International\Geo\Nation 511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cabvmuid = "C:\\Users\\Admin\\AppData\\Roaming\\comcodel\\batmedui.exe" 511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4236 3532 WerFault.exe batmedui.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
batmedui.exepid process 3532 batmedui.exe 3532 batmedui.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.execmd.execmd.exebatmedui.exedescription pid process target process PID 4120 wrote to memory of 4644 4120 511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exe cmd.exe PID 4120 wrote to memory of 4644 4120 511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exe cmd.exe PID 4120 wrote to memory of 4644 4120 511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exe cmd.exe PID 4644 wrote to memory of 4612 4644 cmd.exe cmd.exe PID 4644 wrote to memory of 4612 4644 cmd.exe cmd.exe PID 4644 wrote to memory of 4612 4644 cmd.exe cmd.exe PID 4612 wrote to memory of 3532 4612 cmd.exe batmedui.exe PID 4612 wrote to memory of 3532 4612 cmd.exe batmedui.exe PID 4612 wrote to memory of 3532 4612 cmd.exe batmedui.exe PID 3532 wrote to memory of 2460 3532 batmedui.exe svchost.exe PID 3532 wrote to memory of 2460 3532 batmedui.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exe"C:\Users\Admin\AppData\Local\Temp\511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CE36\671B.bat" "C:\Users\Admin\AppData\Roaming\comcodel\batmedui.exe" "C:\Users\Admin\AppData\Local\Temp\511ABC~1.EXE""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\comcodel\batmedui.exe" "C:\Users\Admin\AppData\Local\Temp\511ABC~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\comcodel\batmedui.exe"C:\Users\Admin\AppData\Roaming\comcodel\batmedui.exe" "C:\Users\Admin\AppData\Local\Temp\511ABC~1.EXE"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 5845⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3532 -ip 35321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CE36\671B.batFilesize
112B
MD54647a5b564f9c2b5a02cbf648b469b34
SHA112cfa9c3fca1b46b9547d46e73cf9717600484de
SHA25671c36b2f3d06c3555ba7a1c5d3b13368bab86c5e3c86c500378322a45c719628
SHA512f584a7894ebd7e3ea78402052e238987d495c36247189b0bcb20646f7122055ffe5a5da98ee86645acd6c7fff863a4a0c27247acaa6e860ae6739ad280be0f7a
-
C:\Users\Admin\AppData\Roaming\comcodel\batmedui.exeFilesize
388KB
MD53474be0fade46da14a1875ed0ab1367b
SHA1771fec73856533568dc757c719389142109ce3c4
SHA256511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be
SHA512142e88d130552cf0ad4dfbaac394a56ecfc5bf2e07f4137db4323894310d4c215d70b1e9712d45b840e13e56d69c007e93b1018f24ba003794857123f95e3b94
-
C:\Users\Admin\AppData\Roaming\comcodel\batmedui.exeFilesize
388KB
MD53474be0fade46da14a1875ed0ab1367b
SHA1771fec73856533568dc757c719389142109ce3c4
SHA256511abcddfa725780593528ef56944433c92089e49bbf75b005fed739ae3b82be
SHA512142e88d130552cf0ad4dfbaac394a56ecfc5bf2e07f4137db4323894310d4c215d70b1e9712d45b840e13e56d69c007e93b1018f24ba003794857123f95e3b94
-
memory/3532-137-0x0000000000000000-mapping.dmp
-
memory/3532-140-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/3532-142-0x00000000006A0000-0x00000000006D0000-memory.dmpFilesize
192KB
-
memory/4120-130-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/4120-131-0x0000000000630000-0x0000000000660000-memory.dmpFilesize
192KB
-
memory/4120-134-0x0000000000630000-0x0000000000660000-memory.dmpFilesize
192KB
-
memory/4612-136-0x0000000000000000-mapping.dmp
-
memory/4644-133-0x0000000000000000-mapping.dmp