Analysis
- max time kernel
159s - max time network
211s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
02/10/2022, 15:05
General
- Target SquirrelsFlow_beta/launcher v5.7.1.exe
- Size 730.3MB
- Sample221002-sf581sdcdn
- SHA256 040d15a2ef782301ffbcdf4f2a1d7b810a9be14d2f94bdfa3eb65255239ad359
Malware Config
Signatures
- Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SquirrelsFlow_beta\launcher v5.7.1.exe"C:\Users\Admin\AppData\Local\Temp\SquirrelsFlow_beta\launcher v5.7.1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1560-140-0x0000000005650000-0x000000000568C000-memory.dmp
memory/1560-146-0x00000000075C0000-0x0000000007636000-memory.dmp
memory/1560-136-0x0000000000400000-0x0000000000484000-memory.dmp
memory/1560-137-0x0000000005B60000-0x0000000006178000-memory.dmp
memory/1560-138-0x00000000056B0000-0x00000000057BA000-memory.dmp
memory/1560-139-0x00000000055F0000-0x0000000005602000-memory.dmp
memory/1560-142-0x0000000006870000-0x0000000006E14000-memory.dmp
memory/1560-147-0x0000000007070000-0x000000000708E000-memory.dmp
memory/1560-143-0x00000000062C0000-0x0000000006326000-memory.dmp
memory/1560-144-0x00000000070F0000-0x00000000072B2000-memory.dmp
memory/1560-145-0x0000000008000000-0x000000000852C000-memory.dmp
memory/1560-141-0x0000000006220000-0x00000000062B2000-memory.dmp
memory/4820-132-0x00000000000B0000-0x0000000000865000-memory.dmp