Overview

overview

8

Static

static

O# GOSUSNH1637860.exe

windows7-x64

8

O# GOSUSNH1637860.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/01/2023, 08:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    O# GOSUSNH1637860.exe
  • Size 446KB
  • Sample230109-kd568sha7y
  • SHA256 492cabb55a2f649ce32194e8f9737a51f071b370bc9cd527aa8cd0b844ee7ea8
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Users\Admin\AppData\Local\Temp\O# GOSUSNH1637860.exe
      "C:\Users\Admin\AppData\Local\Temp\O# GOSUSNH1637860.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Users\Admin\AppData\Local\Temp\wtntqgh.exe
        "C:\Users\Admin\AppData\Local\Temp\wtntqgh.exe" C:\Users\Admin\AppData\Local\Temp\ydiwhrzgns.ry
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Users\Admin\AppData\Local\Temp\wtntqgh.exe
          "C:\Users\Admin\AppData\Local\Temp\wtntqgh.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:3328
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4204
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:4404
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 4404 -s 184
            4⤵
            • Program crash
            PID:632
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 424 -p 4404 -ip 4404
      1⤵
        PID:3392

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            inydik.w
            • Path C:\Users\Admin\AppData\Local\Temp\inydik.w
            • Size 205KB
            • SHA256 ef39a7b6e751c946b5e86dd764d06b4673f99718728a015f951130a10906a334
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wtntqgh.exe
            • Path C:\Users\Admin\AppData\Local\Temp\wtntqgh.exe
            • Size 57KB
            • SHA256 15fc1446c5ada4695d74affb7bedfecb5cf144d3055033c5a2d2b23ac2f7e16b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wtntqgh.exe
            • Path C:\Users\Admin\AppData\Local\Temp\wtntqgh.exe
            • Size 57KB
            • SHA256 15fc1446c5ada4695d74affb7bedfecb5cf144d3055033c5a2d2b23ac2f7e16b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wtntqgh.exe
            • Path C:\Users\Admin\AppData\Local\Temp\wtntqgh.exe
            • Size 57KB
            • SHA256 15fc1446c5ada4695d74affb7bedfecb5cf144d3055033c5a2d2b23ac2f7e16b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ydiwhrzgns.ry
            • Path C:\Users\Admin\AppData\Local\Temp\ydiwhrzgns.ry
            • Size 5KB
            • SHA256 49f2d22336d5e731c047d8ff167e365320e844a1d7fad43f025258d5bb747fc1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/2376-142-0x00000000033C0000-0x00000000034E3000-memory.dmp
            Download

            memory/2376-150-0x0000000003240000-0x0000000003306000-memory.dmp
            Download

            memory/2376-149-0x0000000003240000-0x0000000003306000-memory.dmp
            Download

            memory/3328-140-0x00000000009C0000-0x0000000000D0A000-memory.dmp
            Download

            memory/3328-141-0x0000000000430000-0x0000000000440000-memory.dmp
            Download

            memory/3328-144-0x0000000000400000-0x000000000042F000-memory.dmp
            Download

            memory/3328-139-0x0000000000400000-0x000000000042F000-memory.dmp
            Download

            memory/4204-145-0x0000000000760000-0x0000000000774000-memory.dmp
            Download

            memory/4204-146-0x00000000004D0000-0x00000000004FD000-memory.dmp
            Download

            memory/4204-147-0x00000000023F0000-0x000000000273A000-memory.dmp
            Download

            memory/4204-148-0x0000000002220000-0x00000000022AF000-memory.dmp
            Download