Analysis

  • max time kernel
    599s
  • max time network
    500s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2022 23:52

General

  • Target

    026fd6ab8b5f12d1ae0795f7ad79b05a7ca1dc83e996cb7ee37f1b417d66de44.exe

  • Size

    302KB

  • MD5

    f870c0d62691fc39194922e4a59fdc1c

  • SHA1

    69369a1aa35592ca4eede5179060f2c58e9bae6e

  • SHA256

    026fd6ab8b5f12d1ae0795f7ad79b05a7ca1dc83e996cb7ee37f1b417d66de44

  • SHA512

    92a452a2f63e9e214f98d14fcee1dd8f8c55b94ce90ed541986af08117f09779e159f76ae043ab6be4c49d254e4846448b632e0f33fcafb0be362a90a1a934ae

  • SSDEEP

    6144:qTBSsdUvHN91B8LdCCoVupEo5KdEBaxRxnxXOWFi2HAwsih5:oUJvHNnBGdpOupzEdEByxW2g

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1010

C2

sys.cwthecw.com/bcms/assets/img

sys.whyblacklivesmatter.org/bcms/assets/img

sys.mohitsagarmusic.com/bcms/assets/img

lansystemstat.com/bcms/assets/img

highnetwork.pw/bcms/assets/img

lostnetwork.in/bcms/assets/img

sysconnections.net/bcms/assets/img

lansupports.com/bcms/assets/img

Attributes
  • exe_type

    worker

  • server_id

    35

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:3360
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:4960
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:3692
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          1⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3004
          • C:\Users\Admin\AppData\Local\Temp\026fd6ab8b5f12d1ae0795f7ad79b05a7ca1dc83e996cb7ee37f1b417d66de44.exe
            "C:\Users\Admin\AppData\Local\Temp\026fd6ab8b5f12d1ae0795f7ad79b05a7ca1dc83e996cb7ee37f1b417d66de44.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1380
            • C:\Users\Admin\AppData\Local\Temp\026fd6ab8b5f12d1ae0795f7ad79b05a7ca1dc83e996cb7ee37f1b417d66de44.exe
              "C:\Users\Admin\AppData\Local\Temp\026fd6ab8b5f12d1ae0795f7ad79b05a7ca1dc83e996cb7ee37f1b417d66de44.exe"
              3⤵
                PID:4984
              • C:\Users\Admin\AppData\Local\Temp\026fd6ab8b5f12d1ae0795f7ad79b05a7ca1dc83e996cb7ee37f1b417d66de44.exe
                "C:\Users\Admin\AppData\Local\Temp\026fd6ab8b5f12d1ae0795f7ad79b05a7ca1dc83e996cb7ee37f1b417d66de44.exe"
                3⤵
                • Checks computer location settings
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:1780
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1750\D08E.bat" "C:\Users\Admin\AppData\Roaming\AppVider\Authbk32.exe" "C:\Users\Admin\AppData\Local\Temp\026FD6~1.EXE""
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:372
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /C ""C:\Users\Admin\AppData\Roaming\AppVider\Authbk32.exe" "C:\Users\Admin\AppData\Local\Temp\026FD6~1.EXE""
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2556
                    • C:\Users\Admin\AppData\Roaming\AppVider\Authbk32.exe
                      "C:\Users\Admin\AppData\Roaming\AppVider\Authbk32.exe" "C:\Users\Admin\AppData\Local\Temp\026FD6~1.EXE"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:1984
                      • C:\Users\Admin\AppData\Roaming\AppVider\Authbk32.exe
                        "C:\Users\Admin\AppData\Roaming\AppVider\Authbk32.exe"
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of WriteProcessMemory
                        PID:4264
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe
                          8⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of WriteProcessMemory
                          PID:4304

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Defense Evasion

          Modify Registry

          1
          T1112

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\1750\D08E.bat
            Filesize

            112B

            MD5

            f56711036239d9672e0dcf1f522eed58

            SHA1

            02fe9fd812c9eaf95201fd5102c6261c5c2fa990

            SHA256

            adb76a26873753c74894801754a5f509cbca0fecd170cc018b6b4f0a330790f0

            SHA512

            67bfcafa6c2e9b4d6c0cb52b2639b390ec1a06eda0d70037edd8e0aefc60cd3f3629b3bdaba1ce4b246b8dc4115c04c3320b652ebb203b405d3e135ca8272309

          • C:\Users\Admin\AppData\Roaming\AppVider\Authbk32.exe
            Filesize

            302KB

            MD5

            f870c0d62691fc39194922e4a59fdc1c

            SHA1

            69369a1aa35592ca4eede5179060f2c58e9bae6e

            SHA256

            026fd6ab8b5f12d1ae0795f7ad79b05a7ca1dc83e996cb7ee37f1b417d66de44

            SHA512

            92a452a2f63e9e214f98d14fcee1dd8f8c55b94ce90ed541986af08117f09779e159f76ae043ab6be4c49d254e4846448b632e0f33fcafb0be362a90a1a934ae

          • C:\Users\Admin\AppData\Roaming\AppVider\Authbk32.exe
            Filesize

            302KB

            MD5

            f870c0d62691fc39194922e4a59fdc1c

            SHA1

            69369a1aa35592ca4eede5179060f2c58e9bae6e

            SHA256

            026fd6ab8b5f12d1ae0795f7ad79b05a7ca1dc83e996cb7ee37f1b417d66de44

            SHA512

            92a452a2f63e9e214f98d14fcee1dd8f8c55b94ce90ed541986af08117f09779e159f76ae043ab6be4c49d254e4846448b632e0f33fcafb0be362a90a1a934ae

          • C:\Users\Admin\AppData\Roaming\AppVider\Authbk32.exe
            Filesize

            302KB

            MD5

            f870c0d62691fc39194922e4a59fdc1c

            SHA1

            69369a1aa35592ca4eede5179060f2c58e9bae6e

            SHA256

            026fd6ab8b5f12d1ae0795f7ad79b05a7ca1dc83e996cb7ee37f1b417d66de44

            SHA512

            92a452a2f63e9e214f98d14fcee1dd8f8c55b94ce90ed541986af08117f09779e159f76ae043ab6be4c49d254e4846448b632e0f33fcafb0be362a90a1a934ae

          • memory/372-139-0x0000000000000000-mapping.dmp
          • memory/1780-136-0x0000000000400000-0x0000000000439000-memory.dmp
            Filesize

            228KB

          • memory/1780-138-0x0000000000400000-0x0000000000439000-memory.dmp
            Filesize

            228KB

          • memory/1780-140-0x0000000000400000-0x0000000000439000-memory.dmp
            Filesize

            228KB

          • memory/1780-137-0x0000000000400000-0x0000000000439000-memory.dmp
            Filesize

            228KB

          • memory/1780-134-0x0000000000400000-0x0000000000439000-memory.dmp
            Filesize

            228KB

          • memory/1780-133-0x0000000000000000-mapping.dmp
          • memory/1984-143-0x0000000000000000-mapping.dmp
          • memory/2556-142-0x0000000000000000-mapping.dmp
          • memory/3004-184-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-174-0x0000000002720000-0x0000000002730000-memory.dmp
            Filesize

            64KB

          • memory/3004-199-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-198-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-197-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-196-0x0000000002970000-0x0000000002980000-memory.dmp
            Filesize

            64KB

          • memory/3004-195-0x00000000021F0000-0x0000000002200000-memory.dmp
            Filesize

            64KB

          • memory/3004-194-0x00000000021E0000-0x00000000021F0000-memory.dmp
            Filesize

            64KB

          • memory/3004-193-0x00000000021F0000-0x0000000002200000-memory.dmp
            Filesize

            64KB

          • memory/3004-158-0x0000000002850000-0x00000000028DA000-memory.dmp
            Filesize

            552KB

          • memory/3004-192-0x0000000002970000-0x0000000002980000-memory.dmp
            Filesize

            64KB

          • memory/3004-191-0x00000000021F0000-0x0000000002200000-memory.dmp
            Filesize

            64KB

          • memory/3004-161-0x0000000002970000-0x0000000002980000-memory.dmp
            Filesize

            64KB

          • memory/3004-162-0x00000000021E0000-0x00000000021F0000-memory.dmp
            Filesize

            64KB

          • memory/3004-163-0x00000000021F0000-0x0000000002200000-memory.dmp
            Filesize

            64KB

          • memory/3004-164-0x00000000021F0000-0x0000000002200000-memory.dmp
            Filesize

            64KB

          • memory/3004-165-0x00000000021E0000-0x00000000021F0000-memory.dmp
            Filesize

            64KB

          • memory/3004-166-0x00000000021F0000-0x0000000002200000-memory.dmp
            Filesize

            64KB

          • memory/3004-167-0x00000000021F0000-0x0000000002200000-memory.dmp
            Filesize

            64KB

          • memory/3004-168-0x0000000002970000-0x0000000002980000-memory.dmp
            Filesize

            64KB

          • memory/3004-169-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-170-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-171-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-172-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-173-0x0000000002970000-0x0000000002980000-memory.dmp
            Filesize

            64KB

          • memory/3004-190-0x0000000002970000-0x0000000002980000-memory.dmp
            Filesize

            64KB

          • memory/3004-175-0x0000000002720000-0x0000000002730000-memory.dmp
            Filesize

            64KB

          • memory/3004-176-0x0000000002720000-0x0000000002730000-memory.dmp
            Filesize

            64KB

          • memory/3004-177-0x0000000002720000-0x0000000002730000-memory.dmp
            Filesize

            64KB

          • memory/3004-178-0x0000000002720000-0x0000000002730000-memory.dmp
            Filesize

            64KB

          • memory/3004-179-0x0000000002720000-0x0000000002730000-memory.dmp
            Filesize

            64KB

          • memory/3004-180-0x0000000002970000-0x0000000002980000-memory.dmp
            Filesize

            64KB

          • memory/3004-181-0x0000000002240000-0x0000000002250000-memory.dmp
            Filesize

            64KB

          • memory/3004-182-0x0000000002970000-0x0000000002980000-memory.dmp
            Filesize

            64KB

          • memory/3004-183-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-189-0x00000000021E0000-0x00000000021F0000-memory.dmp
            Filesize

            64KB

          • memory/3004-185-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-186-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-187-0x00000000026B0000-0x00000000026C0000-memory.dmp
            Filesize

            64KB

          • memory/3004-188-0x0000000002970000-0x0000000002980000-memory.dmp
            Filesize

            64KB

          • memory/3360-157-0x000001DE9A920000-0x000001DE9A9AA000-memory.dmp
            Filesize

            552KB

          • memory/3692-159-0x000001D6D4440000-0x000001D6D44CA000-memory.dmp
            Filesize

            552KB

          • memory/4264-146-0x0000000000000000-mapping.dmp
          • memory/4264-154-0x0000000000400000-0x0000000000439000-memory.dmp
            Filesize

            228KB

          • memory/4264-152-0x0000000000400000-0x0000000000439000-memory.dmp
            Filesize

            228KB

          • memory/4264-151-0x0000000000400000-0x0000000000439000-memory.dmp
            Filesize

            228KB

          • memory/4304-156-0x00000000004B0000-0x000000000053A000-memory.dmp
            Filesize

            552KB

          • memory/4304-155-0x00000000004B0000-0x000000000053A000-memory.dmp
            Filesize

            552KB

          • memory/4304-153-0x0000000000000000-mapping.dmp
          • memory/4960-160-0x0000026FBCE20000-0x0000026FBCEAA000-memory.dmp
            Filesize

            552KB

          • memory/4984-132-0x0000000000000000-mapping.dmp