Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 19:13
Static task
static1
Behavioral task
behavioral1
Sample
96691a5722177bd3b92d898458b51bf624a6fd3c83ba03f6c1a9c2088171931e.dll
Resource
win7-20220901-en
General
-
Target
96691a5722177bd3b92d898458b51bf624a6fd3c83ba03f6c1a9c2088171931e.dll
-
Size
398KB
-
MD5
a2f914433461b45fc5505e9f89683625
-
SHA1
a004c119c923990c3cc93c4eff5dcf4a7cf45bf6
-
SHA256
96691a5722177bd3b92d898458b51bf624a6fd3c83ba03f6c1a9c2088171931e
-
SHA512
e0bed07bb6f97c0e685ece31654c2bb147d78a11530740451376b267738e6af430f13c5e5b50d96ec4ba81d2a9c770a2f085c3b5ba38ec6078eb4a0b2e196ba8
-
SSDEEP
12288:skELFg2bL3yXTmLwkHIvJuXK1+OB0wmylK+IUGJH+O:sxy2wm9R+O
Malware Config
Extracted
gozi
Extracted
gozi
5500
windows.update.com
shop.microsoft.com
fraloopilo.xyz
paladingrazz.xyz
-
base_path
/manifest/
-
build
250177
-
dga_season
10
-
exe_type
loader
-
extension
.cnx
-
server_id
12
Signatures
-
Processes:
iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "404257811" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "404413410" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d019c4181634d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007973b20a5ab3f243b2509807fe356abc0000000002000000000010660000000100002000000046ab53c08274363001a6dbfbdc2a06165d181e23716851dc2f9f82d31f519777000000000e80000000020000200000007eff42af0662751d2803d8e8e9e3b58878f423c40a425ae78ab3196eaf6bb232200000002e90dfdf8788dfd11e75ddec9c36801f836f1b9d5e039babf56f4a04adfb07d4400000003fc3a7811a297d7683c27cffbecc97bb86f801e66b3efb140c953f448daae246eab18aff98fc7cd2361274ef9dd76d6221fa3f1b74a51e6a6db256545e0be63e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203ea0181634d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007973b20a5ab3f243b2509807fe356abc0000000002000000000010660000000100002000000065209863850b96cb67ad75ba752b8c331dccd45e231f85f0ea3d32b42bc922d1000000000e800000000200002000000073eeb1766d5b036bc37ce5c189a91c7cf32d1ee746296f8ffc4e8607fc9bd62120000000f44ee9c67bf775073df2a7f914f3ac88d9d59f02878798cd18f4dadeb3af1f2a40000000e8bb0b7d12d22a80c9afeec06c6fbd729ba6e40769de7f1c3fa99ab90508cad4f242a27cfd5f49758190cb66b543b3853d15b7c86e759d3889e70db36a8c0a1b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007973b20a5ab3f243b2509807fe356abc0000000002000000000010660000000100002000000033dad120f02767d02b0a35295307e0c46738caab42c1d4d413b0ad8bd3306312000000000e8000000002000020000000502a942d362507d6053356ea85d1ab62ebf24c241dcae71e9bdaca74a77f443e20000000baecd04b21a8e3970474cb70f26c349d2c5aaf7c71339083aff470434a26e46c400000008667bdfca5dd02ae8778eb3fa8422479a784a646c08bbd1ea74e06c9600e578e62b76076b3575e77f4aa94975d310150505e5ab520e4c1a1b242127513806934 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011862" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011862" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007973b20a5ab3f243b2509807fe356abc00000000020000000000106600000001000020000000eaff8ee4dc007cc6c5a5ff998d02642d56e3353d29fff33f71ba64006dd95f0d000000000e8000000002000020000000dd005375de77327209de07b421eaf148d8d7d876cacc0f7a5194fb4ed4bf9de920000000f365b6e572686f97c0038cd0788fd80c0e027004fb260609045598d275c6d1fb40000000d10b02bcaf7bd27fbaeb26e59465a2d4ecaaa28bc25e5f9d3b3adf76c51f0a1c5cbcc90dc571c0bc91cba5f09beb9056eaea92a11e154c8325f8afe6739f8c9a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{69BF1709-A009-11ED-A0EE-7A46CE8ECE48} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5CAE152E-A009-11ED-A0EE-7A46CE8ECE48} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8015be2c1634d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600dad1f1634d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4327081A-A009-11ED-A0EE-7A46CE8ECE48} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exepid process 4604 iexplore.exe 3580 iexplore.exe 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 4604 iexplore.exe 4604 iexplore.exe 1948 IEXPLORE.EXE 1948 IEXPLORE.EXE 3580 iexplore.exe 3580 iexplore.exe 624 IEXPLORE.EXE 624 IEXPLORE.EXE 1700 iexplore.exe 1700 iexplore.exe 5112 IEXPLORE.EXE 5112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
rundll32.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 3736 wrote to memory of 3012 3736 rundll32.exe rundll32.exe PID 3736 wrote to memory of 3012 3736 rundll32.exe rundll32.exe PID 3736 wrote to memory of 3012 3736 rundll32.exe rundll32.exe PID 4604 wrote to memory of 1948 4604 iexplore.exe IEXPLORE.EXE PID 4604 wrote to memory of 1948 4604 iexplore.exe IEXPLORE.EXE PID 4604 wrote to memory of 1948 4604 iexplore.exe IEXPLORE.EXE PID 3580 wrote to memory of 624 3580 iexplore.exe IEXPLORE.EXE PID 3580 wrote to memory of 624 3580 iexplore.exe IEXPLORE.EXE PID 3580 wrote to memory of 624 3580 iexplore.exe IEXPLORE.EXE PID 1700 wrote to memory of 5112 1700 iexplore.exe IEXPLORE.EXE PID 1700 wrote to memory of 5112 1700 iexplore.exe IEXPLORE.EXE PID 1700 wrote to memory of 5112 1700 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\96691a5722177bd3b92d898458b51bf624a6fd3c83ba03f6c1a9c2088171931e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\96691a5722177bd3b92d898458b51bf624a6fd3c83ba03f6c1a9c2088171931e.dll,#12⤵
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4604 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3580 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3012-132-0x0000000000000000-mapping.dmp
-
memory/3012-134-0x00000000756D0000-0x000000007574A000-memory.dmpFilesize
488KB
-
memory/3012-133-0x00000000756D0000-0x00000000756DF000-memory.dmpFilesize
60KB
-
memory/3012-135-0x00000000756D0000-0x000000007574A000-memory.dmpFilesize
488KB
-
memory/3012-136-0x00000000756D0000-0x000000007574A000-memory.dmpFilesize
488KB
-
memory/3012-137-0x0000000001140000-0x0000000001150000-memory.dmpFilesize
64KB