Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-02-2023 15:15
Static task
static1
General
-
Target
x.dll
-
Size
676KB
-
MD5
24d3053553df1154d1fb54fd42280a11
-
SHA1
11ccb1e60a006fbb16dc22943bc02c8ead438e63
-
SHA256
547fedb6eb80520a462cb62b7981e9c6a0078d5ce3ccb04528638677207d0f52
-
SHA512
7b8dd915ae965abbff302a10d9cc2c9ecd0c918599311a2a5328c4e9880d661beb0f9c3421f42d0f01ba6a7a69542205551e6101798fb304679b650e1ff4b4f1
-
SSDEEP
12288:Zcm3gYGSxS1mSki7mJMXU2UNIHPc3dzlTyZrXOp9u0LN29BBaSAeLlNu/EvVmltT:Zcm3IqwmJMXPHPc3dr9LQDBaSAsNIEve
Malware Config
Extracted
gozi
Extracted
gozi
1000
https://colodart.top
-
host_keep_time
2
-
host_shift_time
1
-
idle_time
1
-
request_time
10
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
taskmgr.exepid process 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 4312 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 4312 taskmgr.exe Token: SeSystemProfilePrivilege 4312 taskmgr.exe Token: SeCreateGlobalPrivilege 4312 taskmgr.exe Token: 33 4312 taskmgr.exe Token: SeIncBasePriorityPrivilege 4312 taskmgr.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
Processes:
taskmgr.exepid process 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
Processes:
taskmgr.exepid process 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe 4312 taskmgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
regsvr32.execmd.execmd.exenet.exedescription pid process target process PID 3232 wrote to memory of 2072 3232 regsvr32.exe cmd.exe PID 3232 wrote to memory of 2072 3232 regsvr32.exe cmd.exe PID 2072 wrote to memory of 4540 2072 cmd.exe nltest.exe PID 2072 wrote to memory of 4540 2072 cmd.exe nltest.exe PID 3232 wrote to memory of 1452 3232 regsvr32.exe cmd.exe PID 3232 wrote to memory of 1452 3232 regsvr32.exe cmd.exe PID 1452 wrote to memory of 2864 1452 cmd.exe net.exe PID 1452 wrote to memory of 2864 1452 cmd.exe net.exe PID 2864 wrote to memory of 4464 2864 net.exe net1.exe PID 2864 wrote to memory of 4464 2864 net.exe net1.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\x.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c "nltest /dclist:" >> C:\Users\Admin\AppData\Local\Temp\150E.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\nltest.exenltest /dclist:3⤵
-
C:\Windows\system32\cmd.execmd /c "net group "domain computers" /domain" >> C:\Users\Admin\AppData\Local\Temp\3CFB.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet group "domain computers" /domain3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group "domain computers" /domain4⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\150E.tmpFilesize
36B
MD5c58986635c266e6c06609b908580bede
SHA14672dce03d3dd9560cf74035aff3d9aebb7201e4
SHA256a2f1bb2817f976e129974b003e3ec12fb8a644c1952bb667116317fd26416042
SHA51236241e4bda8ad7e4137624bbfbb999c643d34a2095ba078f9886d92f4726913bdb9dc1e1f44141a6738c1e4d9042b802e49f774c0f1c6901735f4b069834449f
-
C:\Users\Admin\AppData\Local\Temp\3CFB.tmpFilesize
78B
MD5aaec14b2de8e2fdaf8427672122af65c
SHA1ca953efad669c93af85b968d747baa544d4465fb
SHA25614c94c44d0eb89a820d96e1791f4b754c87ee778b5f4478289df0fb22e1c3da1
SHA512a5cbad3de5070fdcd6aa7f3f5eda42b69faef44a431cf48e20ca1f4f42c648ee80bd5f1d9b981624ae6b39e2435b4278c9fd1e97491e3b244a2bba7d629021a8
-
memory/3232-117-0x00000000022C0000-0x0000000002373000-memory.dmpFilesize
716KB
-
memory/3232-119-0x0000000180000000-0x0000000180014000-memory.dmpFilesize
80KB
-
memory/3232-125-0x0000000002490000-0x00000000024A3000-memory.dmpFilesize
76KB
-
memory/3232-130-0x0000000002450000-0x0000000002451000-memory.dmpFilesize
4KB
-
memory/3232-136-0x00000000022C0000-0x0000000002373000-memory.dmpFilesize
716KB