Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 21:07
Static task
static1
Behavioral task
behavioral1
Sample
4f81a7ee4dc2bf2a7179ec01dea866b6bcfd980e527e8fdc817c2f30d490c67a.dll
Resource
win7-20221111-en
General
-
Target
4f81a7ee4dc2bf2a7179ec01dea866b6bcfd980e527e8fdc817c2f30d490c67a.dll
-
Size
1.1MB
-
MD5
3267b8df7235b5333b7ac00059273fc1
-
SHA1
fb722196edc83de5c147d1bef4eb676d0ff67543
-
SHA256
4f81a7ee4dc2bf2a7179ec01dea866b6bcfd980e527e8fdc817c2f30d490c67a
-
SHA512
7c3ebdbfd368fb2e9794271a8d7bbef0e3753e2186dc6c4ef04d54590250c4a50d1b30ab0068f264b1f8872e99b14e5428a7a46f39343cd8a7f87aa51cbbe487
-
SSDEEP
24576:i30ixqmP/+GZgTXrHJB+pffKUmHaRLNW0wfpKncbBWZtxjB/s69pTGxUcbrJOBPO:i30ixj/aTXrH7+pHKUmHeLNW0wBKnc4K
Malware Config
Extracted
gozi
Extracted
gozi
1000
http://ey7kuuklgieop2pq.onion
http://drunt.at
http://news-deck.at
http://taslks.at
-
build
217107
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Signatures
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\comsspex = "rundll32 \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Acletall\\DfsSspci.dll\",DllRegisterServer" Explorer.EXE -
Suspicious use of SetThreadContext 4 IoCs
Processes:
rundll32.execontrol.exeExplorer.EXEdescription pid process target process PID 1712 set thread context of 1288 1712 rundll32.exe control.exe PID 1288 set thread context of 1312 1288 control.exe Explorer.EXE PID 1288 set thread context of 652 1288 control.exe rundll32.exe PID 1312 set thread context of 1256 1312 Explorer.EXE cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeExplorer.EXEpid process 1712 rundll32.exe 1312 Explorer.EXE -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
rundll32.execontrol.exeExplorer.EXEpid process 1712 rundll32.exe 1288 control.exe 1288 control.exe 1312 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1312 Explorer.EXE 1312 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1312 Explorer.EXE 1312 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 1312 Explorer.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
rundll32.exerundll32.execontrol.exeExplorer.EXEcmd.exedescription pid process target process PID 1208 wrote to memory of 1712 1208 rundll32.exe rundll32.exe PID 1208 wrote to memory of 1712 1208 rundll32.exe rundll32.exe PID 1208 wrote to memory of 1712 1208 rundll32.exe rundll32.exe PID 1208 wrote to memory of 1712 1208 rundll32.exe rundll32.exe PID 1208 wrote to memory of 1712 1208 rundll32.exe rundll32.exe PID 1208 wrote to memory of 1712 1208 rundll32.exe rundll32.exe PID 1208 wrote to memory of 1712 1208 rundll32.exe rundll32.exe PID 1712 wrote to memory of 1288 1712 rundll32.exe control.exe PID 1712 wrote to memory of 1288 1712 rundll32.exe control.exe PID 1712 wrote to memory of 1288 1712 rundll32.exe control.exe PID 1712 wrote to memory of 1288 1712 rundll32.exe control.exe PID 1712 wrote to memory of 1288 1712 rundll32.exe control.exe PID 1712 wrote to memory of 1288 1712 rundll32.exe control.exe PID 1712 wrote to memory of 1288 1712 rundll32.exe control.exe PID 1288 wrote to memory of 1312 1288 control.exe Explorer.EXE PID 1288 wrote to memory of 1312 1288 control.exe Explorer.EXE PID 1288 wrote to memory of 1312 1288 control.exe Explorer.EXE PID 1288 wrote to memory of 652 1288 control.exe rundll32.exe PID 1288 wrote to memory of 652 1288 control.exe rundll32.exe PID 1288 wrote to memory of 652 1288 control.exe rundll32.exe PID 1288 wrote to memory of 652 1288 control.exe rundll32.exe PID 1288 wrote to memory of 652 1288 control.exe rundll32.exe PID 1288 wrote to memory of 652 1288 control.exe rundll32.exe PID 1312 wrote to memory of 1696 1312 Explorer.EXE cmd.exe PID 1312 wrote to memory of 1696 1312 Explorer.EXE cmd.exe PID 1312 wrote to memory of 1696 1312 Explorer.EXE cmd.exe PID 1696 wrote to memory of 1964 1696 cmd.exe nslookup.exe PID 1696 wrote to memory of 1964 1696 cmd.exe nslookup.exe PID 1696 wrote to memory of 1964 1696 cmd.exe nslookup.exe PID 1312 wrote to memory of 1460 1312 Explorer.EXE cmd.exe PID 1312 wrote to memory of 1460 1312 Explorer.EXE cmd.exe PID 1312 wrote to memory of 1460 1312 Explorer.EXE cmd.exe PID 1312 wrote to memory of 1256 1312 Explorer.EXE cmd.exe PID 1312 wrote to memory of 1256 1312 Explorer.EXE cmd.exe PID 1312 wrote to memory of 1256 1312 Explorer.EXE cmd.exe PID 1312 wrote to memory of 1256 1312 Explorer.EXE cmd.exe PID 1312 wrote to memory of 1256 1312 Explorer.EXE cmd.exe PID 1312 wrote to memory of 1256 1312 Explorer.EXE cmd.exe PID 1312 wrote to memory of 1256 1312 Explorer.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4f81a7ee4dc2bf2a7179ec01dea866b6bcfd980e527e8fdc817c2f30d490c67a.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4f81a7ee4dc2bf2a7179ec01dea866b6bcfd980e527e8fdc817c2f30d490c67a.dll,#13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\control.exeC:\Windows\system32\control.exe /?4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?5⤵
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\3FC4.bi1"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3FC4.bi1"2⤵
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3FC4.bi1Filesize
118B
MD541a49d1a2a3a8713a12ccf89932d4bb7
SHA1b324e8bbcd4ca71a35d0c00ac63c0255e8ec4287
SHA256f210a8e30967b13dabe340c45ce4a97e9c94ad74975728eccdd0a27edf29b5fe
SHA5121fc256f2068eb9ac32c04bad119e94ba006808fd2be48db397eecf69acd6d8972334f81f8439d6e153a9cb99db618a613f3b0adf2b5784c264b61d4d5c0669b1
-
C:\Users\Admin\AppData\Local\Temp\3FC4.bi1Filesize
118B
MD541a49d1a2a3a8713a12ccf89932d4bb7
SHA1b324e8bbcd4ca71a35d0c00ac63c0255e8ec4287
SHA256f210a8e30967b13dabe340c45ce4a97e9c94ad74975728eccdd0a27edf29b5fe
SHA5121fc256f2068eb9ac32c04bad119e94ba006808fd2be48db397eecf69acd6d8972334f81f8439d6e153a9cb99db618a613f3b0adf2b5784c264b61d4d5c0669b1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Acletall\DfsSspci.dllFilesize
1.1MB
MD53267b8df7235b5333b7ac00059273fc1
SHA1fb722196edc83de5c147d1bef4eb676d0ff67543
SHA2564f81a7ee4dc2bf2a7179ec01dea866b6bcfd980e527e8fdc817c2f30d490c67a
SHA5127c3ebdbfd368fb2e9794271a8d7bbef0e3753e2186dc6c4ef04d54590250c4a50d1b30ab0068f264b1f8872e99b14e5428a7a46f39343cd8a7f87aa51cbbe487
-
memory/652-74-0x0000000001B10000-0x0000000001BC4000-memory.dmpFilesize
720KB
-
memory/652-72-0x0000000000000000-mapping.dmp
-
memory/1256-82-0x00000000002E0000-0x0000000000387000-memory.dmpFilesize
668KB
-
memory/1256-81-0x0000000000000000-mapping.dmp
-
memory/1288-73-0x0000000001BD0000-0x0000000001C84000-memory.dmpFilesize
720KB
-
memory/1288-67-0x0000000000000000-mapping.dmp
-
memory/1288-69-0x0000000001BD0000-0x0000000001C84000-memory.dmpFilesize
720KB
-
memory/1288-70-0x000007FEFBAC1000-0x000007FEFBAC3000-memory.dmpFilesize
8KB
-
memory/1312-75-0x0000000004CF0000-0x0000000004DA4000-memory.dmpFilesize
720KB
-
memory/1460-78-0x0000000000000000-mapping.dmp
-
memory/1696-76-0x0000000000000000-mapping.dmp
-
memory/1712-68-0x0000000010000000-0x0000000010A16000-memory.dmpFilesize
10.1MB
-
memory/1712-60-0x0000000000150000-0x000000000019B000-memory.dmpFilesize
300KB
-
memory/1712-59-0x0000000010000000-0x0000000010A16000-memory.dmpFilesize
10.1MB
-
memory/1712-54-0x0000000000000000-mapping.dmp
-
memory/1712-58-0x0000000010000000-0x0000000010A16000-memory.dmpFilesize
10.1MB
-
memory/1712-57-0x0000000010000000-0x0000000010A16000-memory.dmpFilesize
10.1MB
-
memory/1712-56-0x0000000010000000-0x000000001004D000-memory.dmpFilesize
308KB
-
memory/1712-55-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/1964-77-0x0000000000000000-mapping.dmp