Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08-02-2023 20:10

General

  • Target

    7083c049037004acf270e8ce3f6bb25c502d8df38aab9e3a3cbd131444478cda.exe

  • Size

    321KB

  • MD5

    1e512df0f26079e52376064f1a7ec019

  • SHA1

    858a5465ed0f9fda9ab35945e765c44abcc4f230

  • SHA256

    7083c049037004acf270e8ce3f6bb25c502d8df38aab9e3a3cbd131444478cda

  • SHA512

    a2877121db47e6a3694c282d25a89a4869cd0fcc45f9dae555831baf497ed5db0ee5e24bb0965b3a1869574a936bc843d350512404269fe6f6ffeef79207c29c

  • SSDEEP

    3072:oPgQ/NddxR9DMe4Cpk3gD0ooHGiylyUIx705sXos5vsWQDiuLpp9gv:orDrDMcC3RCyUIx70uXOLiqkv

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1001

C2

https://checklist.skype.com

http://176.10.125.84

http://91.242.219.235

http://79.132.130.73

http://176.10.119.209

http://194.76.225.88

http://79.132.134.158

Attributes
  • base_path

    /microsoft/

  • build

    260255

  • exe_type

    loader

  • extension

    .acx

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

laplas

C2

http://45.159.189.105

Attributes
  • api_key

    ad75d4e2e9636ca662a337b6e798d36159f23acfc89bbe9400d0d451bd8d69fd

Signatures

  • Detects Smokeloader packer 1 IoCs
  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7083c049037004acf270e8ce3f6bb25c502d8df38aab9e3a3cbd131444478cda.exe
    "C:\Users\Admin\AppData\Local\Temp\7083c049037004acf270e8ce3f6bb25c502d8df38aab9e3a3cbd131444478cda.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3520
  • C:\Users\Admin\AppData\Local\Temp\33B2.exe
    C:\Users\Admin\AppData\Local\Temp\33B2.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
      2⤵
      • Creates scheduled task(s)
      PID:3992
  • C:\Users\Admin\AppData\Local\Temp\3569.exe
    C:\Users\Admin\AppData\Local\Temp\3569.exe
    1⤵
    • Executes dropped EXE
    PID:4376
  • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
    C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
    1⤵
    • Executes dropped EXE
    PID:5048

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\33B2.exe

    Filesize

    378KB

    MD5

    b141bc58618c537917cc1da179cbe8ab

    SHA1

    c76d3f5eeae9493e41a272a974b5dfec5f4e4724

    SHA256

    fd999e4a07d8b3d95f9d9231fd496b0125b56094f1b03ddca7a7b074c1d8c03e

    SHA512

    5c72f63124a394602a36a4f985e33a41e8159f54653f431c270b8f0fa8e13131517c31b497a936d5f5d3d27397f40fc7909efc4bfd04c01bcca7f306860c3114

  • C:\Users\Admin\AppData\Local\Temp\33B2.exe

    Filesize

    378KB

    MD5

    b141bc58618c537917cc1da179cbe8ab

    SHA1

    c76d3f5eeae9493e41a272a974b5dfec5f4e4724

    SHA256

    fd999e4a07d8b3d95f9d9231fd496b0125b56094f1b03ddca7a7b074c1d8c03e

    SHA512

    5c72f63124a394602a36a4f985e33a41e8159f54653f431c270b8f0fa8e13131517c31b497a936d5f5d3d27397f40fc7909efc4bfd04c01bcca7f306860c3114

  • C:\Users\Admin\AppData\Local\Temp\3569.exe

    Filesize

    172KB

    MD5

    185596291815d84f3894dbeef5ea54e7

    SHA1

    6ff9c5982d02187a4e9961a98ab490ba479ed8e2

    SHA256

    3d723b2eac949a522f1d0d48d060a528cb275ae14803762200a760fdf9720e11

    SHA512

    99f61314609ce59795d7dce5c17a1564a18613d8babe242d192b83911c8baf0f746067e9aee08609da5f0d5514cb761c1364859f082bc1d18c6ecc7208f28eb5

  • C:\Users\Admin\AppData\Local\Temp\3569.exe

    Filesize

    172KB

    MD5

    185596291815d84f3894dbeef5ea54e7

    SHA1

    6ff9c5982d02187a4e9961a98ab490ba479ed8e2

    SHA256

    3d723b2eac949a522f1d0d48d060a528cb275ae14803762200a760fdf9720e11

    SHA512

    99f61314609ce59795d7dce5c17a1564a18613d8babe242d192b83911c8baf0f746067e9aee08609da5f0d5514cb761c1364859f082bc1d18c6ecc7208f28eb5

  • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe

    Filesize

    512.9MB

    MD5

    a29fb3d2af39aa8317b755967529d9ba

    SHA1

    0290d865cc09d1909de2faaceb0b3574655d6ffb

    SHA256

    be2574f3b9015aa712a9a5b5931da51b65af8db1a74d2c226f7ab331e5cc620a

    SHA512

    fcbfde637df244d51f8aee669aa4f58e6179d77aee9b61b487cc58901d92212ac09394ad776e6a8e3510a91b5286b33aea0d1249124cd1c912c8d4a81ebfda4c

  • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe

    Filesize

    509.1MB

    MD5

    cde0e8d6f27ace752429ea33d38f499b

    SHA1

    e2c971e682decb74fd52130320d3fc1ce2138d2e

    SHA256

    322b595e504e66d9e19957fdd6c9672e55155762ae9397142d8ac5201aefc34c

    SHA512

    9f0d5c0be3cc80e3de684c6436c239de11275c9cfea02f29b4ed1fb8756887011b9afb333ef61e71e67510c117fefe80a5ec714059b4bea2c61f56a7149f5ff7

  • memory/3520-139-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-143-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-125-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-126-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-127-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-128-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-129-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-130-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-131-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-132-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-133-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-134-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-135-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-136-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-137-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-138-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-123-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-140-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-142-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-124-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-145-0x00000000006E0000-0x000000000082A000-memory.dmp

    Filesize

    1.3MB

  • memory/3520-146-0x00000000006B0000-0x00000000006B9000-memory.dmp

    Filesize

    36KB

  • memory/3520-144-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-147-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-148-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-149-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-150-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-151-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-152-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-153-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-154-0x0000000000400000-0x000000000058F000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-155-0x0000000000400000-0x000000000058F000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-122-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-121-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-120-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-118-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-117-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3520-119-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/3992-266-0x0000000000000000-mapping.dmp

  • memory/4376-185-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-174-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-286-0x0000000000ED0000-0x0000000000EDE000-memory.dmp

    Filesize

    56KB

  • memory/4376-192-0x0000000000ED0000-0x0000000000EDE000-memory.dmp

    Filesize

    56KB

  • memory/4376-165-0x0000000000000000-mapping.dmp

  • memory/4376-189-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-170-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-172-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-191-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-190-0x0000000000EB0000-0x0000000000EC1000-memory.dmp

    Filesize

    68KB

  • memory/4376-188-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-187-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-181-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-186-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-179-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-177-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4376-184-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-160-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-194-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-161-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-175-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-164-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-162-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-180-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-178-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-176-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-173-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-168-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-163-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-193-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-171-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-197-0x0000000000590000-0x00000000006DA000-memory.dmp

    Filesize

    1.3MB

  • memory/4384-199-0x0000000000590000-0x00000000006DA000-memory.dmp

    Filesize

    1.3MB

  • memory/4384-214-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/4384-159-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-268-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/4384-167-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-158-0x0000000077B00000-0x0000000077C8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4384-156-0x0000000000000000-mapping.dmp

  • memory/5048-324-0x0000000000500000-0x000000000064A000-memory.dmp

    Filesize

    1.3MB

  • memory/5048-325-0x00000000020D0000-0x0000000002117000-memory.dmp

    Filesize

    284KB

  • memory/5048-326-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/5048-339-0x0000000000500000-0x000000000064A000-memory.dmp

    Filesize

    1.3MB