Analysis
-
max time kernel
112s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 18:05
Static task
static1
Behavioral task
behavioral1
Sample
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe
Resource
win10v2004-20220414-en
General
-
Target
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe
-
Size
351KB
-
MD5
640a6ec2eb0dd677c61aa38cd2b447e8
-
SHA1
cad702cddcf7a4b88b53708a97c12b6a5f13ac72
-
SHA256
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406
-
SHA512
4e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Actipi32.exepid process 4092 Actipi32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AcWioker = "C:\\Users\\Admin\\AppData\\Roaming\\Addrdlet\\Actipi32.exe" 4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4424 4092 WerFault.exe Actipi32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Actipi32.exepid process 4092 Actipi32.exe 4092 Actipi32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.execmd.execmd.exeActipi32.exedescription pid process target process PID 4284 wrote to memory of 4584 4284 4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe cmd.exe PID 4284 wrote to memory of 4584 4284 4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe cmd.exe PID 4284 wrote to memory of 4584 4284 4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe cmd.exe PID 4584 wrote to memory of 4580 4584 cmd.exe cmd.exe PID 4584 wrote to memory of 4580 4584 cmd.exe cmd.exe PID 4584 wrote to memory of 4580 4584 cmd.exe cmd.exe PID 4580 wrote to memory of 4092 4580 cmd.exe Actipi32.exe PID 4580 wrote to memory of 4092 4580 cmd.exe Actipi32.exe PID 4580 wrote to memory of 4092 4580 cmd.exe Actipi32.exe PID 4092 wrote to memory of 872 4092 Actipi32.exe svchost.exe PID 4092 wrote to memory of 872 4092 Actipi32.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe"C:\Users\Admin\AppData\Local\Temp\4e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9494\13.bat" "C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe" "C:\Users\Admin\AppData\Local\Temp\4E4B34~1.EXE""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe" "C:\Users\Admin\AppData\Local\Temp\4E4B34~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe"C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exe" "C:\Users\Admin\AppData\Local\Temp\4E4B34~1.EXE"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 5845⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4092 -ip 40921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9494\13.batFilesize
112B
MD59a2ecba54459944255c9f43a33f71a84
SHA175ac1b1ca756cb9691b3725a789dc73910b5094a
SHA2561cd3ccd4da831c384096a047eb7e282228aa1e428d7000605ca26ff012f3eab8
SHA5123de91a3578549a03c16c69e11965031960d37280d7e7586324fb15dcfec499c9efc7e8a423931145c1776904aa9e0ab0a0b89508add685b889842685b96d94ee
-
C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exeFilesize
351KB
MD5640a6ec2eb0dd677c61aa38cd2b447e8
SHA1cad702cddcf7a4b88b53708a97c12b6a5f13ac72
SHA2564e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406
SHA5124e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36
-
C:\Users\Admin\AppData\Roaming\Addrdlet\Actipi32.exeFilesize
351KB
MD5640a6ec2eb0dd677c61aa38cd2b447e8
SHA1cad702cddcf7a4b88b53708a97c12b6a5f13ac72
SHA2564e4b34bdcbdb30a84551eab03fcf1233a592d4c7090b32fb4a9199b02dd72406
SHA5124e73a875877def4b1feadcbdef622b1a6cc214bdfa608edc6c354bdf038a8e85ffe5eb9c2d5d2d900acd33d6c31fe1d27b6d1846287c2829500ee93c51cbab36
-
memory/4092-136-0x0000000000000000-mapping.dmp
-
memory/4092-139-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/4092-141-0x0000000000570000-0x00000000005A0000-memory.dmpFilesize
192KB
-
memory/4284-130-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/4284-132-0x00000000006E0000-0x0000000000710000-memory.dmpFilesize
192KB
-
memory/4580-135-0x0000000000000000-mapping.dmp
-
memory/4584-133-0x0000000000000000-mapping.dmp