Analysis
-
max time kernel
43s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 18:05
Static task
static1
Behavioral task
behavioral1
Sample
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe
Resource
win10v2004-20220414-en
General
-
Target
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe
-
Size
351KB
-
MD5
640a6ec2eb0dd677c61aa38cd2b447e8
-
SHA1
cad702cddcf7a4b88b53708a97c12b6a5f13ac72
-
SHA256
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406
-
SHA512
4e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
AuxilAPI.exepid process 1096 AuxilAPI.exe -
Deletes itself 1 IoCs
Processes:
AuxilAPI.exepid process 1096 AuxilAPI.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1332 cmd.exe 1332 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\d3d8wave = "C:\\Users\\Admin\\AppData\\Roaming\\compOMEX\\AuxilAPI.exe" 4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
AuxilAPI.exesvchost.exedescription pid process target process PID 1096 set thread context of 2028 1096 AuxilAPI.exe svchost.exe PID 2028 set thread context of 1384 2028 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AuxilAPI.exeExplorer.EXEpid process 1096 AuxilAPI.exe 1384 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
AuxilAPI.exesvchost.exepid process 1096 AuxilAPI.exe 2028 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.execmd.execmd.exeAuxilAPI.exesvchost.exedescription pid process target process PID 1768 wrote to memory of 944 1768 4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe cmd.exe PID 1768 wrote to memory of 944 1768 4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe cmd.exe PID 1768 wrote to memory of 944 1768 4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe cmd.exe PID 1768 wrote to memory of 944 1768 4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe cmd.exe PID 944 wrote to memory of 1332 944 cmd.exe cmd.exe PID 944 wrote to memory of 1332 944 cmd.exe cmd.exe PID 944 wrote to memory of 1332 944 cmd.exe cmd.exe PID 944 wrote to memory of 1332 944 cmd.exe cmd.exe PID 1332 wrote to memory of 1096 1332 cmd.exe AuxilAPI.exe PID 1332 wrote to memory of 1096 1332 cmd.exe AuxilAPI.exe PID 1332 wrote to memory of 1096 1332 cmd.exe AuxilAPI.exe PID 1332 wrote to memory of 1096 1332 cmd.exe AuxilAPI.exe PID 1096 wrote to memory of 2028 1096 AuxilAPI.exe svchost.exe PID 1096 wrote to memory of 2028 1096 AuxilAPI.exe svchost.exe PID 1096 wrote to memory of 2028 1096 AuxilAPI.exe svchost.exe PID 1096 wrote to memory of 2028 1096 AuxilAPI.exe svchost.exe PID 1096 wrote to memory of 2028 1096 AuxilAPI.exe svchost.exe PID 1096 wrote to memory of 2028 1096 AuxilAPI.exe svchost.exe PID 1096 wrote to memory of 2028 1096 AuxilAPI.exe svchost.exe PID 2028 wrote to memory of 1384 2028 svchost.exe Explorer.EXE PID 2028 wrote to memory of 1384 2028 svchost.exe Explorer.EXE PID 2028 wrote to memory of 1384 2028 svchost.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe"C:\Users\Admin\AppData\Local\Temp\4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\4E80\2740.bat" "C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe" "C:\Users\Admin\AppData\Local\Temp\4E4B34~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe" "C:\Users\Admin\AppData\Local\Temp\4E4B34~1.EXE""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe"C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exe" "C:\Users\Admin\AppData\Local\Temp\4E4B34~1.EXE"5⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4E80\2740.batFilesize
108B
MD59f3cbfcb26769203f0bcf954ccef80c8
SHA1d0a61e3044fdee128f8b0aa58ab733852f013dc8
SHA256310f56f99cac13043fee603c69a7b2c8238a59eac6d2a2a906f0b292b5a99edd
SHA5125f1761cf44b6cdc2e9de56394f12a8d4aa065ddc3829a11812108ff08149f586af00016b5ff1db64b73262ea8bcb4f50dfef227f24bf6d912edb0e64ae12bb1a
-
C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exeFilesize
351KB
MD5640a6ec2eb0dd677c61aa38cd2b447e8
SHA1cad702cddcf7a4b88b53708a97c12b6a5f13ac72
SHA2564e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406
SHA5124e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36
-
C:\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exeFilesize
351KB
MD5640a6ec2eb0dd677c61aa38cd2b447e8
SHA1cad702cddcf7a4b88b53708a97c12b6a5f13ac72
SHA2564e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406
SHA5124e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36
-
\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exeFilesize
351KB
MD5640a6ec2eb0dd677c61aa38cd2b447e8
SHA1cad702cddcf7a4b88b53708a97c12b6a5f13ac72
SHA2564e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406
SHA5124e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36
-
\Users\Admin\AppData\Roaming\compOMEX\AuxilAPI.exeFilesize
351KB
MD5640a6ec2eb0dd677c61aa38cd2b447e8
SHA1cad702cddcf7a4b88b53708a97c12b6a5f13ac72
SHA2564e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406
SHA5124e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36
-
memory/944-58-0x0000000000000000-mapping.dmp
-
memory/1096-64-0x0000000000000000-mapping.dmp
-
memory/1096-67-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1096-69-0x00000000003B0000-0x00000000003E0000-memory.dmpFilesize
192KB
-
memory/1332-60-0x0000000000000000-mapping.dmp
-
memory/1384-72-0x0000000002BB0000-0x0000000002C25000-memory.dmpFilesize
468KB
-
memory/1384-73-0x0000000002BB0000-0x0000000002C25000-memory.dmpFilesize
468KB
-
memory/1768-57-0x00000000003D0000-0x0000000000400000-memory.dmpFilesize
192KB
-
memory/1768-54-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB
-
memory/1768-55-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/2028-70-0x0000000000000000-mapping.dmp
-
memory/2028-71-0x00000000000D0000-0x0000000000145000-memory.dmpFilesize
468KB