Analysis
-
max time kernel
55s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
02-08-2022 00:29
Static task
static1
Behavioral task
behavioral1
Sample
5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe
Resource
win10v2004-20220722-en
General
-
Target
5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe
-
Size
361KB
-
MD5
64139ece03d78520b9dae8d1313da69e
-
SHA1
45e19e267688c8472ce882afe93becb043b718d1
-
SHA256
5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80
-
SHA512
2daa3467bb5bb3af17f94503946eab4f07e8a7e09906ed54d843aa80ae90ced32d574b08b7c1ee78c56d3a7a950799cafa9705d1c39df3e9888865a004db7b84
Malware Config
Extracted
gozi_ifsb
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ctl3an32.exepid process 1820 ctl3an32.exe -
Deletes itself 1 IoCs
Processes:
ctl3an32.exepid process 1820 ctl3an32.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1636 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\certLSys = "C:\\Users\\Admin\\AppData\\Roaming\\bidiprop\\ctl3an32.exe" 5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ctl3an32.exesvchost.exedescription pid process target process PID 1820 set thread context of 1640 1820 ctl3an32.exe svchost.exe PID 1640 set thread context of 1260 1640 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ctl3an32.exeExplorer.EXEpid process 1820 ctl3an32.exe 1260 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
ctl3an32.exesvchost.exepid process 1820 ctl3an32.exe 1640 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.execmd.execmd.exectl3an32.exesvchost.exedescription pid process target process PID 1776 wrote to memory of 1740 1776 5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe cmd.exe PID 1776 wrote to memory of 1740 1776 5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe cmd.exe PID 1776 wrote to memory of 1740 1776 5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe cmd.exe PID 1776 wrote to memory of 1740 1776 5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe cmd.exe PID 1740 wrote to memory of 1636 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 1636 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 1636 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 1636 1740 cmd.exe cmd.exe PID 1636 wrote to memory of 1820 1636 cmd.exe ctl3an32.exe PID 1636 wrote to memory of 1820 1636 cmd.exe ctl3an32.exe PID 1636 wrote to memory of 1820 1636 cmd.exe ctl3an32.exe PID 1636 wrote to memory of 1820 1636 cmd.exe ctl3an32.exe PID 1820 wrote to memory of 1640 1820 ctl3an32.exe svchost.exe PID 1820 wrote to memory of 1640 1820 ctl3an32.exe svchost.exe PID 1820 wrote to memory of 1640 1820 ctl3an32.exe svchost.exe PID 1820 wrote to memory of 1640 1820 ctl3an32.exe svchost.exe PID 1820 wrote to memory of 1640 1820 ctl3an32.exe svchost.exe PID 1820 wrote to memory of 1640 1820 ctl3an32.exe svchost.exe PID 1820 wrote to memory of 1640 1820 ctl3an32.exe svchost.exe PID 1640 wrote to memory of 1260 1640 svchost.exe Explorer.EXE PID 1640 wrote to memory of 1260 1640 svchost.exe Explorer.EXE PID 1640 wrote to memory of 1260 1640 svchost.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe"C:\Users\Admin\AppData\Local\Temp\5b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\736E\70.bat" "C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exe" "C:\Users\Admin\AppData\Local\Temp\5B3F58~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exe" "C:\Users\Admin\AppData\Local\Temp\5B3F58~1.EXE""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exe"C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exe" "C:\Users\Admin\AppData\Local\Temp\5B3F58~1.EXE"5⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\736E\70.batFilesize
108B
MD540a00c74df8c56ae457cd6a6f9c89641
SHA16b22476e10f3911a70ade4b921f52e11caba4abd
SHA25623dc54261eaf67de6899f6ecd419ccc11830f23b9683c44a36ac08f1ca50bc01
SHA512ddace174e71423ffd1bfdb4d825b9df5e960b7e85d3b341a56cf4d4a5d2d4b2c565222341e99624995e8ededf17ce314d5b9ab6582e11329413e672c3b04cbd6
-
C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exeFilesize
361KB
MD564139ece03d78520b9dae8d1313da69e
SHA145e19e267688c8472ce882afe93becb043b718d1
SHA2565b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80
SHA5122daa3467bb5bb3af17f94503946eab4f07e8a7e09906ed54d843aa80ae90ced32d574b08b7c1ee78c56d3a7a950799cafa9705d1c39df3e9888865a004db7b84
-
C:\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exeFilesize
361KB
MD564139ece03d78520b9dae8d1313da69e
SHA145e19e267688c8472ce882afe93becb043b718d1
SHA2565b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80
SHA5122daa3467bb5bb3af17f94503946eab4f07e8a7e09906ed54d843aa80ae90ced32d574b08b7c1ee78c56d3a7a950799cafa9705d1c39df3e9888865a004db7b84
-
\Users\Admin\AppData\Roaming\bidiprop\ctl3an32.exeFilesize
361KB
MD564139ece03d78520b9dae8d1313da69e
SHA145e19e267688c8472ce882afe93becb043b718d1
SHA2565b3f58a5ad9ff0c0a11055d34a08ec2a046144c82f88f1e2735f794402705c80
SHA5122daa3467bb5bb3af17f94503946eab4f07e8a7e09906ed54d843aa80ae90ced32d574b08b7c1ee78c56d3a7a950799cafa9705d1c39df3e9888865a004db7b84
-
memory/1260-73-0x0000000002990000-0x0000000002A05000-memory.dmpFilesize
468KB
-
memory/1260-72-0x0000000002990000-0x0000000002A05000-memory.dmpFilesize
468KB
-
memory/1636-60-0x0000000000000000-mapping.dmp
-
memory/1640-69-0x0000000000000000-mapping.dmp
-
memory/1640-70-0x00000000000D0000-0x0000000000145000-memory.dmpFilesize
468KB
-
memory/1640-71-0x00000000000D0000-0x0000000000145000-memory.dmpFilesize
468KB
-
memory/1740-58-0x0000000000000000-mapping.dmp
-
memory/1776-54-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/1776-57-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB
-
memory/1776-55-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/1820-63-0x0000000000000000-mapping.dmp
-
memory/1820-66-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/1820-68-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB