Analysis
-
max time kernel
149s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 02:54
Static task
static1
Behavioral task
behavioral1
Sample
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe
Resource
win10v2004-20220721-en
General
-
Target
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe
-
Size
388KB
-
MD5
87e6bfe8246e3a4f050f4e19db909985
-
SHA1
e61b8afaff9a929a78fee1195977e9b275566694
-
SHA256
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac
-
SHA512
3482e5ab3be2f036c2edfc80d9645a9a8ce0a1d1c865ce6b1b7b56404ba623f529a2fac04052131182b5d70b4129e0b8209fbea62521ad9cf61520cdfb3ba26b
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
adsngpui.exepid process 604 adsngpui.exe -
Deletes itself 1 IoCs
Processes:
adsngpui.exepid process 604 adsngpui.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1628 cmd.exe 1628 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\Devipast = "C:\\Users\\Admin\\AppData\\Roaming\\avictnet\\adsngpui.exe" 59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
adsngpui.exesvchost.exedescription pid process target process PID 604 set thread context of 1296 604 adsngpui.exe svchost.exe PID 1296 set thread context of 1256 1296 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
adsngpui.exeExplorer.EXEpid process 604 adsngpui.exe 1256 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
adsngpui.exesvchost.exepid process 604 adsngpui.exe 1296 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.execmd.execmd.exeadsngpui.exesvchost.exedescription pid process target process PID 1908 wrote to memory of 948 1908 59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe cmd.exe PID 1908 wrote to memory of 948 1908 59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe cmd.exe PID 1908 wrote to memory of 948 1908 59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe cmd.exe PID 1908 wrote to memory of 948 1908 59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe cmd.exe PID 948 wrote to memory of 1628 948 cmd.exe cmd.exe PID 948 wrote to memory of 1628 948 cmd.exe cmd.exe PID 948 wrote to memory of 1628 948 cmd.exe cmd.exe PID 948 wrote to memory of 1628 948 cmd.exe cmd.exe PID 1628 wrote to memory of 604 1628 cmd.exe adsngpui.exe PID 1628 wrote to memory of 604 1628 cmd.exe adsngpui.exe PID 1628 wrote to memory of 604 1628 cmd.exe adsngpui.exe PID 1628 wrote to memory of 604 1628 cmd.exe adsngpui.exe PID 604 wrote to memory of 1296 604 adsngpui.exe svchost.exe PID 604 wrote to memory of 1296 604 adsngpui.exe svchost.exe PID 604 wrote to memory of 1296 604 adsngpui.exe svchost.exe PID 604 wrote to memory of 1296 604 adsngpui.exe svchost.exe PID 604 wrote to memory of 1296 604 adsngpui.exe svchost.exe PID 604 wrote to memory of 1296 604 adsngpui.exe svchost.exe PID 604 wrote to memory of 1296 604 adsngpui.exe svchost.exe PID 1296 wrote to memory of 1256 1296 svchost.exe Explorer.EXE PID 1296 wrote to memory of 1256 1296 svchost.exe Explorer.EXE PID 1296 wrote to memory of 1256 1296 svchost.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe"C:\Users\Admin\AppData\Local\Temp\59c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\77D2\3BE9.bat" "C:\Users\Admin\AppData\Roaming\avictnet\adsngpui.exe" "C:\Users\Admin\AppData\Local\Temp\59C467~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\avictnet\adsngpui.exe" "C:\Users\Admin\AppData\Local\Temp\59C467~1.EXE""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\avictnet\adsngpui.exe"C:\Users\Admin\AppData\Roaming\avictnet\adsngpui.exe" "C:\Users\Admin\AppData\Local\Temp\59C467~1.EXE"5⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\77D2\3BE9.batFilesize
108B
MD50e25c953386c8926bc9e0ed86efe1d5f
SHA123321c146bc2631731ffe27f6dca476935b20541
SHA25692d03d3e680d92f8632567d608312636faa4867d31b8edae6dbfb4eed0a9a215
SHA512a1bab8e80649f23ac2cc46ffa19ff696a3068e0773289f941fedd9c5357e42b3d3f43219dd892ba7e3b25634f87b103bb800e3dbb59903bf994985553635044e
-
C:\Users\Admin\AppData\Roaming\avictnet\adsngpui.exeFilesize
388KB
MD587e6bfe8246e3a4f050f4e19db909985
SHA1e61b8afaff9a929a78fee1195977e9b275566694
SHA25659c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac
SHA5123482e5ab3be2f036c2edfc80d9645a9a8ce0a1d1c865ce6b1b7b56404ba623f529a2fac04052131182b5d70b4129e0b8209fbea62521ad9cf61520cdfb3ba26b
-
C:\Users\Admin\AppData\Roaming\avictnet\adsngpui.exeFilesize
388KB
MD587e6bfe8246e3a4f050f4e19db909985
SHA1e61b8afaff9a929a78fee1195977e9b275566694
SHA25659c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac
SHA5123482e5ab3be2f036c2edfc80d9645a9a8ce0a1d1c865ce6b1b7b56404ba623f529a2fac04052131182b5d70b4129e0b8209fbea62521ad9cf61520cdfb3ba26b
-
\Users\Admin\AppData\Roaming\avictnet\adsngpui.exeFilesize
388KB
MD587e6bfe8246e3a4f050f4e19db909985
SHA1e61b8afaff9a929a78fee1195977e9b275566694
SHA25659c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac
SHA5123482e5ab3be2f036c2edfc80d9645a9a8ce0a1d1c865ce6b1b7b56404ba623f529a2fac04052131182b5d70b4129e0b8209fbea62521ad9cf61520cdfb3ba26b
-
\Users\Admin\AppData\Roaming\avictnet\adsngpui.exeFilesize
388KB
MD587e6bfe8246e3a4f050f4e19db909985
SHA1e61b8afaff9a929a78fee1195977e9b275566694
SHA25659c467d1529372aa56b7b9f88e50a1ae79da537f435f1a4fad7711f86b1653ac
SHA5123482e5ab3be2f036c2edfc80d9645a9a8ce0a1d1c865ce6b1b7b56404ba623f529a2fac04052131182b5d70b4129e0b8209fbea62521ad9cf61520cdfb3ba26b
-
memory/604-69-0x00000000002B0000-0x00000000002E0000-memory.dmpFilesize
192KB
-
memory/604-64-0x0000000000000000-mapping.dmp
-
memory/604-67-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/948-58-0x0000000000000000-mapping.dmp
-
memory/1256-74-0x00000000029E0000-0x0000000002A55000-memory.dmpFilesize
468KB
-
memory/1256-73-0x00000000029E0000-0x0000000002A55000-memory.dmpFilesize
468KB
-
memory/1296-71-0x00000000001C0000-0x0000000000235000-memory.dmpFilesize
468KB
-
memory/1296-70-0x0000000000000000-mapping.dmp
-
memory/1296-72-0x00000000001C0000-0x0000000000235000-memory.dmpFilesize
468KB
-
memory/1628-60-0x0000000000000000-mapping.dmp
-
memory/1908-54-0x00000000754D1000-0x00000000754D3000-memory.dmpFilesize
8KB
-
memory/1908-57-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/1908-55-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB