Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
26-07-2022 18:32
Static task
static1
Behavioral task
behavioral1
Sample
53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.exe
Resource
win10v2004-20220722-en
General
-
Target
53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.exe
-
Size
474KB
-
MD5
8c923cc9562628ba9c41748c2bb1c2d3
-
SHA1
d02a1b75c3a060b7be1371eca9a475b60e027353
-
SHA256
53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c
-
SHA512
e451c5784d17a944b4f41309e1c6be3c012b071e49da87c05b12eb2e416a62b6dd455ff159f516a7aa3a16ac0e1c202e1c87b7abd7533b69c0f7940f428ce677
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
crypwcfg.exepid process 1956 crypwcfg.exe -
Deletes itself 1 IoCs
Processes:
crypwcfg.exepid process 1956 crypwcfg.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1916 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\clbcrole = "C:\\Users\\Admin\\AppData\\Roaming\\dmustcls\\crypwcfg.exe" 53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
crypwcfg.exesvchost.exedescription pid process target process PID 1956 set thread context of 948 1956 crypwcfg.exe svchost.exe PID 948 set thread context of 1428 948 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
crypwcfg.exeExplorer.EXEpid process 1956 crypwcfg.exe 1428 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
crypwcfg.exesvchost.exepid process 1956 crypwcfg.exe 948 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1428 Explorer.EXE 1428 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1428 Explorer.EXE 1428 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1428 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.execmd.execmd.execrypwcfg.exesvchost.exedescription pid process target process PID 308 wrote to memory of 1660 308 53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.exe cmd.exe PID 308 wrote to memory of 1660 308 53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.exe cmd.exe PID 308 wrote to memory of 1660 308 53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.exe cmd.exe PID 308 wrote to memory of 1660 308 53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.exe cmd.exe PID 1660 wrote to memory of 1916 1660 cmd.exe cmd.exe PID 1660 wrote to memory of 1916 1660 cmd.exe cmd.exe PID 1660 wrote to memory of 1916 1660 cmd.exe cmd.exe PID 1660 wrote to memory of 1916 1660 cmd.exe cmd.exe PID 1916 wrote to memory of 1956 1916 cmd.exe crypwcfg.exe PID 1916 wrote to memory of 1956 1916 cmd.exe crypwcfg.exe PID 1916 wrote to memory of 1956 1916 cmd.exe crypwcfg.exe PID 1916 wrote to memory of 1956 1916 cmd.exe crypwcfg.exe PID 1956 wrote to memory of 948 1956 crypwcfg.exe svchost.exe PID 1956 wrote to memory of 948 1956 crypwcfg.exe svchost.exe PID 1956 wrote to memory of 948 1956 crypwcfg.exe svchost.exe PID 1956 wrote to memory of 948 1956 crypwcfg.exe svchost.exe PID 1956 wrote to memory of 948 1956 crypwcfg.exe svchost.exe PID 1956 wrote to memory of 948 1956 crypwcfg.exe svchost.exe PID 1956 wrote to memory of 948 1956 crypwcfg.exe svchost.exe PID 948 wrote to memory of 1428 948 svchost.exe Explorer.EXE PID 948 wrote to memory of 1428 948 svchost.exe Explorer.EXE PID 948 wrote to memory of 1428 948 svchost.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.exe"C:\Users\Admin\AppData\Local\Temp\53f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3546\1AA3.bat" "C:\Users\Admin\AppData\Roaming\dmustcls\crypwcfg.exe" "C:\Users\Admin\AppData\Local\Temp\53F126~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\dmustcls\crypwcfg.exe" "C:\Users\Admin\AppData\Local\Temp\53F126~1.EXE""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dmustcls\crypwcfg.exe"C:\Users\Admin\AppData\Roaming\dmustcls\crypwcfg.exe" "C:\Users\Admin\AppData\Local\Temp\53F126~1.EXE"5⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3546\1AA3.batFilesize
108B
MD53b076346d990633d271d07bacdeaa8a8
SHA199521498d2424039d59b5f7366109d423feb68de
SHA256ae0fc7cf855ddf3440307cfd0649b691a71050253e4b7c26c755084eb33bd32c
SHA51264c965eae5627785926efc5ddcd888df564c8d413c0081982e0022ea55b4eceefcfe2e09046ad9e0239c9a25b5bebf3268a423c282d4f11c0351924806508037
-
C:\Users\Admin\AppData\Roaming\dmustcls\crypwcfg.exeFilesize
474KB
MD58c923cc9562628ba9c41748c2bb1c2d3
SHA1d02a1b75c3a060b7be1371eca9a475b60e027353
SHA25653f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c
SHA512e451c5784d17a944b4f41309e1c6be3c012b071e49da87c05b12eb2e416a62b6dd455ff159f516a7aa3a16ac0e1c202e1c87b7abd7533b69c0f7940f428ce677
-
C:\Users\Admin\AppData\Roaming\dmustcls\crypwcfg.exeFilesize
474KB
MD58c923cc9562628ba9c41748c2bb1c2d3
SHA1d02a1b75c3a060b7be1371eca9a475b60e027353
SHA25653f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c
SHA512e451c5784d17a944b4f41309e1c6be3c012b071e49da87c05b12eb2e416a62b6dd455ff159f516a7aa3a16ac0e1c202e1c87b7abd7533b69c0f7940f428ce677
-
\Users\Admin\AppData\Roaming\dmustcls\crypwcfg.exeFilesize
474KB
MD58c923cc9562628ba9c41748c2bb1c2d3
SHA1d02a1b75c3a060b7be1371eca9a475b60e027353
SHA25653f1260b4d020c05bd212aa82638df2b5b55d3e608bbf1a019662dd3b299583c
SHA512e451c5784d17a944b4f41309e1c6be3c012b071e49da87c05b12eb2e416a62b6dd455ff159f516a7aa3a16ac0e1c202e1c87b7abd7533b69c0f7940f428ce677
-
memory/308-55-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/308-57-0x00000000002C0000-0x00000000002F0000-memory.dmpFilesize
192KB
-
memory/308-54-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/948-69-0x0000000000000000-mapping.dmp
-
memory/948-70-0x0000000000390000-0x0000000000405000-memory.dmpFilesize
468KB
-
memory/948-71-0x0000000000390000-0x0000000000405000-memory.dmpFilesize
468KB
-
memory/1428-72-0x0000000002A50000-0x0000000002AC5000-memory.dmpFilesize
468KB
-
memory/1428-73-0x0000000002A50000-0x0000000002AC5000-memory.dmpFilesize
468KB
-
memory/1660-58-0x0000000000000000-mapping.dmp
-
memory/1916-60-0x0000000000000000-mapping.dmp
-
memory/1956-63-0x0000000000000000-mapping.dmp
-
memory/1956-66-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1956-68-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB