Analysis

  • max time kernel
    55s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    02-08-2022 00:29

General

  • Target

    5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe

  • Size

    361KB

  • MD5

    64139ece03d78520b9dae8d1313da69e

  • SHA1

    45e19e267688c8472ce882afe93becb043b718d1

  • SHA256

    5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80

  • SHA512

    2daa3467bb5bb3af17f94503946eab4f07e8a7e09906ed54d843aa80ae90ced32d574b08b7c1ee78c56d3a7a950799cafa9705d1c39df3e9888865a004db7b84

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1010

C2

diuolirt.at

deopliazae.at

nifredao.com

filokiyurt.at

Attributes
  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe
      "C:\Users\Admin\AppData\Local\Temp\5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\736E\70.bat" "C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exe" "C:\Users\Admin\AppData\Local\Temp\5B3F58~1.EXE""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C ""C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exe" "C:\Users\Admin\AppData\Local\Temp\5B3F58~1.EXE""
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1636
          • C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exe
            "C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exe" "C:\Users\Admin\AppData\Local\Temp\5B3F58~1.EXE"
            5⤵
            • Executes dropped EXE
            • Deletes itself
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1820
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:1640

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\736E\70.bat
    Filesize

    108B

    MD5

    40a00c74df8c56ae457cd6a6f9c89641

    SHA1

    6b22476e10f3911a70ade4b921f52e11caba4abd

    SHA256

    23dc54261eaf67de6899f6ecd419ccc11830f23b9683c44a36ac08f1ca50bc01

    SHA512

    ddace174e71423ffd1bfdb4d825b9df5e960b7e85d3b341a56cf4d4a5d2d4b2c565222341e99624995e8ededf17ce314d5b9ab6582e11329413e672c3b04cbd6

  • C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exe
    Filesize

    361KB

    MD5

    64139ece03d78520b9dae8d1313da69e

    SHA1

    45e19e267688c8472ce882afe93becb043b718d1

    SHA256

    5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80

    SHA512

    2daa3467bb5bb3af17f94503946eab4f07e8a7e09906ed54d843aa80ae90ced32d574b08b7c1ee78c56d3a7a950799cafa9705d1c39df3e9888865a004db7b84

  • C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exe
    Filesize

    361KB

    MD5

    64139ece03d78520b9dae8d1313da69e

    SHA1

    45e19e267688c8472ce882afe93becb043b718d1

    SHA256

    5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80

    SHA512

    2daa3467bb5bb3af17f94503946eab4f07e8a7e09906ed54d843aa80ae90ced32d574b08b7c1ee78c56d3a7a950799cafa9705d1c39df3e9888865a004db7b84

  • \Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exe
    Filesize

    361KB

    MD5

    64139ece03d78520b9dae8d1313da69e

    SHA1

    45e19e267688c8472ce882afe93becb043b718d1

    SHA256

    5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80

    SHA512

    2daa3467bb5bb3af17f94503946eab4f07e8a7e09906ed54d843aa80ae90ced32d574b08b7c1ee78c56d3a7a950799cafa9705d1c39df3e9888865a004db7b84

  • memory/1260-73-0x0000000002990000-0x0000000002A05000-memory.dmp
    Filesize

    468KB

  • memory/1260-72-0x0000000002990000-0x0000000002A05000-memory.dmp
    Filesize

    468KB

  • memory/1636-60-0x0000000000000000-mapping.dmp
  • memory/1640-69-0x0000000000000000-mapping.dmp
  • memory/1640-70-0x00000000000D0000-0x0000000000145000-memory.dmp
    Filesize

    468KB

  • memory/1640-71-0x00000000000D0000-0x0000000000145000-memory.dmp
    Filesize

    468KB

  • memory/1740-58-0x0000000000000000-mapping.dmp
  • memory/1776-54-0x0000000075B61000-0x0000000075B63000-memory.dmp
    Filesize

    8KB

  • memory/1776-57-0x0000000000230000-0x0000000000260000-memory.dmp
    Filesize

    192KB

  • memory/1776-55-0x0000000000400000-0x000000000045D000-memory.dmp
    Filesize

    372KB

  • memory/1820-63-0x0000000000000000-mapping.dmp
  • memory/1820-66-0x0000000000400000-0x000000000045D000-memory.dmp
    Filesize

    372KB

  • memory/1820-68-0x0000000000230000-0x0000000000260000-memory.dmp
    Filesize

    192KB