Analysis

  • max time kernel
    43s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    20-07-2022 18:05

General

  • Target

    4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe

  • Size

    351KB

  • MD5

    640a6ec2eb0dd677c61aa38cd2b447e8

  • SHA1

    cad702cddcf7a4b88b53708a97c12b6a5f13ac72

  • SHA256

    4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406

  • SHA512

    4e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1010

C2

diuolirt.at

deopliazae.at

nifredao.com

filokiyurt.at

Attributes
  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1384
    • C:\Users\Admin\AppData\Local\Temp\4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe
      "C:\Users\Admin\AppData\Local\Temp\4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4E80\2740.bat" "C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe" "C:\Users\Admin\AppData\Local\Temp\4E4B34~1.EXE""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:944
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C ""C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe" "C:\Users\Admin\AppData\Local\Temp\4E4B34~1.EXE""
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1332
          • C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe
            "C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe" "C:\Users\Admin\AppData\Local\Temp\4E4B34~1.EXE"
            5⤵
            • Executes dropped EXE
            • Deletes itself
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1096
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4E80\2740.bat
    Filesize

    108B

    MD5

    9f3cbfcb26769203f0bcf954ccef80c8

    SHA1

    d0a61e3044fdee128f8b0aa58ab733852f013dc8

    SHA256

    310f56f99cac13043fee603c69a7b2c8238a59eac6d2a2a906f0b292b5a99edd

    SHA512

    5f1761cf44b6cdc2e9de56394f12a8d4aa065ddc3829a11812108ff08149f586af00016b5ff1db64b73262ea8bcb4f50dfef227f24bf6d912edb0e64ae12bb1a

  • C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe
    Filesize

    351KB

    MD5

    640a6ec2eb0dd677c61aa38cd2b447e8

    SHA1

    cad702cddcf7a4b88b53708a97c12b6a5f13ac72

    SHA256

    4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406

    SHA512

    4e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36

  • C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe
    Filesize

    351KB

    MD5

    640a6ec2eb0dd677c61aa38cd2b447e8

    SHA1

    cad702cddcf7a4b88b53708a97c12b6a5f13ac72

    SHA256

    4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406

    SHA512

    4e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36

  • \Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe
    Filesize

    351KB

    MD5

    640a6ec2eb0dd677c61aa38cd2b447e8

    SHA1

    cad702cddcf7a4b88b53708a97c12b6a5f13ac72

    SHA256

    4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406

    SHA512

    4e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36

  • \Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe
    Filesize

    351KB

    MD5

    640a6ec2eb0dd677c61aa38cd2b447e8

    SHA1

    cad702cddcf7a4b88b53708a97c12b6a5f13ac72

    SHA256

    4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406

    SHA512

    4e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36

  • memory/944-58-0x0000000000000000-mapping.dmp
  • memory/1096-64-0x0000000000000000-mapping.dmp
  • memory/1096-67-0x0000000000400000-0x000000000045A000-memory.dmp
    Filesize

    360KB

  • memory/1096-69-0x00000000003B0000-0x00000000003E0000-memory.dmp
    Filesize

    192KB

  • memory/1332-60-0x0000000000000000-mapping.dmp
  • memory/1384-72-0x0000000002BB0000-0x0000000002C25000-memory.dmp
    Filesize

    468KB

  • memory/1384-73-0x0000000002BB0000-0x0000000002C25000-memory.dmp
    Filesize

    468KB

  • memory/1768-57-0x00000000003D0000-0x0000000000400000-memory.dmp
    Filesize

    192KB

  • memory/1768-54-0x00000000764D1000-0x00000000764D3000-memory.dmp
    Filesize

    8KB

  • memory/1768-55-0x0000000000400000-0x000000000045A000-memory.dmp
    Filesize

    360KB

  • memory/2028-70-0x0000000000000000-mapping.dmp
  • memory/2028-71-0x00000000000D0000-0x0000000000145000-memory.dmp
    Filesize

    468KB