Analysis
-
max time kernel
174s -
max time network
65s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-11-2022 07:08
Static task
static1
Behavioral task
behavioral1
Sample
a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755.exe
Resource
win7-20220812-en
General
-
Target
a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755.exe
-
Size
493KB
-
MD5
02e4f7328ea0d24c85becbe13c13bacf
-
SHA1
5534138034a0e0eb0a183ec6143a6762cc27c4f9
-
SHA256
a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755
-
SHA512
d3db4ce11c19cce9cbf26624b865e729e6c00be4c1f32a3cb3e925a870b8e168d507f0d173e5996490316a4b720cf9dbc613f7668bf345a13b1225bbb64b3990
-
SSDEEP
6144:AseFPcfIB+6+AVbYXkbv7xxfC0Gwxbr6hYYJu:/ChB+YVbYUbjxx60b
Malware Config
Extracted
gozi
Extracted
gozi
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
dsroXP32.exepid process 1212 dsroXP32.exe -
Deletes itself 1 IoCs
Processes:
dsroXP32.exepid process 1212 dsroXP32.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1296 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dmvdXT32 = "C:\\Users\\Admin\\AppData\\Roaming\\clbcwcfg\\dsroXP32.exe" a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
dsroXP32.exesvchost.exedescription pid process target process PID 1212 set thread context of 1408 1212 dsroXP32.exe svchost.exe PID 1408 set thread context of 1216 1408 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dsroXP32.exeExplorer.EXEpid process 1212 dsroXP32.exe 1216 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
dsroXP32.exesvchost.exepid process 1212 dsroXP32.exe 1408 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 1216 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755.execmd.execmd.exedsroXP32.exesvchost.exedescription pid process target process PID 1988 wrote to memory of 1508 1988 a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755.exe cmd.exe PID 1988 wrote to memory of 1508 1988 a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755.exe cmd.exe PID 1988 wrote to memory of 1508 1988 a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755.exe cmd.exe PID 1988 wrote to memory of 1508 1988 a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755.exe cmd.exe PID 1508 wrote to memory of 1296 1508 cmd.exe cmd.exe PID 1508 wrote to memory of 1296 1508 cmd.exe cmd.exe PID 1508 wrote to memory of 1296 1508 cmd.exe cmd.exe PID 1508 wrote to memory of 1296 1508 cmd.exe cmd.exe PID 1296 wrote to memory of 1212 1296 cmd.exe dsroXP32.exe PID 1296 wrote to memory of 1212 1296 cmd.exe dsroXP32.exe PID 1296 wrote to memory of 1212 1296 cmd.exe dsroXP32.exe PID 1296 wrote to memory of 1212 1296 cmd.exe dsroXP32.exe PID 1212 wrote to memory of 1408 1212 dsroXP32.exe svchost.exe PID 1212 wrote to memory of 1408 1212 dsroXP32.exe svchost.exe PID 1212 wrote to memory of 1408 1212 dsroXP32.exe svchost.exe PID 1212 wrote to memory of 1408 1212 dsroXP32.exe svchost.exe PID 1212 wrote to memory of 1408 1212 dsroXP32.exe svchost.exe PID 1212 wrote to memory of 1408 1212 dsroXP32.exe svchost.exe PID 1212 wrote to memory of 1408 1212 dsroXP32.exe svchost.exe PID 1408 wrote to memory of 1216 1408 svchost.exe Explorer.EXE PID 1408 wrote to memory of 1216 1408 svchost.exe Explorer.EXE PID 1408 wrote to memory of 1216 1408 svchost.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755.exe"C:\Users\Admin\AppData\Local\Temp\a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\2272\9139.bat" "C:\Users\Admin\AppData\Roaming\clbcwcfg\dsroXP32.exe" "C:\Users\Admin\AppData\Local\Temp\A9FFAE~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\clbcwcfg\dsroXP32.exe" "C:\Users\Admin\AppData\Local\Temp\A9FFAE~1.EXE""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\clbcwcfg\dsroXP32.exe"C:\Users\Admin\AppData\Roaming\clbcwcfg\dsroXP32.exe" "C:\Users\Admin\AppData\Local\Temp\A9FFAE~1.EXE"5⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2272\9139.batFilesize
108B
MD5145e69065ce1772bbd980f531b3e1ac2
SHA14507bebc169ce2269dd6a562784c19db20473c43
SHA256a720084ce5edd6412de9082afcc5368bdb35799793cd84be6b62848101d30e90
SHA512d1b7f0463825190ceaba8469f94d49717025e02e6c22dd7fbfa580ccf7e5d8b77bdd559e619eb8819ea966a992a89ac8aac56f3915eba5fe2b8d0ee93dd86f7c
-
C:\Users\Admin\AppData\Roaming\clbcwcfg\dsroXP32.exeFilesize
493KB
MD502e4f7328ea0d24c85becbe13c13bacf
SHA15534138034a0e0eb0a183ec6143a6762cc27c4f9
SHA256a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755
SHA512d3db4ce11c19cce9cbf26624b865e729e6c00be4c1f32a3cb3e925a870b8e168d507f0d173e5996490316a4b720cf9dbc613f7668bf345a13b1225bbb64b3990
-
C:\Users\Admin\AppData\Roaming\clbcwcfg\dsroXP32.exeFilesize
493KB
MD502e4f7328ea0d24c85becbe13c13bacf
SHA15534138034a0e0eb0a183ec6143a6762cc27c4f9
SHA256a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755
SHA512d3db4ce11c19cce9cbf26624b865e729e6c00be4c1f32a3cb3e925a870b8e168d507f0d173e5996490316a4b720cf9dbc613f7668bf345a13b1225bbb64b3990
-
\Users\Admin\AppData\Roaming\clbcwcfg\dsroXP32.exeFilesize
493KB
MD502e4f7328ea0d24c85becbe13c13bacf
SHA15534138034a0e0eb0a183ec6143a6762cc27c4f9
SHA256a9ffaed3f7276ab6d8472dc457a8d11698426da23d070d9651ce247f9eb33755
SHA512d3db4ce11c19cce9cbf26624b865e729e6c00be4c1f32a3cb3e925a870b8e168d507f0d173e5996490316a4b720cf9dbc613f7668bf345a13b1225bbb64b3990
-
memory/1212-63-0x0000000000000000-mapping.dmp
-
memory/1212-66-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1212-68-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB
-
memory/1216-71-0x0000000002B10000-0x0000000002B85000-memory.dmpFilesize
468KB
-
memory/1216-72-0x0000000002B10000-0x0000000002B85000-memory.dmpFilesize
468KB
-
memory/1296-60-0x0000000000000000-mapping.dmp
-
memory/1408-69-0x0000000000000000-mapping.dmp
-
memory/1408-70-0x00000000003A0000-0x0000000000415000-memory.dmpFilesize
468KB
-
memory/1508-58-0x0000000000000000-mapping.dmp
-
memory/1988-57-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/1988-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1988-55-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB