Overview
overview
10Static
static
1url/Ammini...ne.url
windows10-1703-x64
10url/Ammini...ne.url
windows10-2004-x64
10url/Azienda.url
windows10-1703-x64
10url/Azienda.url
windows10-2004-x64
10url/Cliente.url
windows10-1703-x64
10url/Cliente.url
windows10-2004-x64
10url/Documenti.url
windows10-1703-x64
10url/Documenti.url
windows10-2004-x64
10url/Informazioni.url
windows10-1703-x64
10url/Informazioni.url
windows10-2004-x64
10url/dettagli.url
windows10-1703-x64
10url/dettagli.url
windows10-2004-x64
10url/inform.url
windows10-1703-x64
10url/inform.url
windows10-2004-x64
10url/modulo.url
windows10-1703-x64
10url/modulo.url
windows10-2004-x64
10url/processo.url
windows10-1703-x64
10url/processo.url
windows10-2004-x64
10url/sistema.url
windows10-1703-x64
10url/sistema.url
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
171s -
platform
windows10-1703_x64 -
resource
win10-20230831-en -
resource tags
arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system -
submitted
13-10-2023 01:40
Static task
static1
Behavioral task
behavioral1
Sample
url/Amministrazione.url
Resource
win10-20230915-en
Behavioral task
behavioral2
Sample
url/Amministrazione.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
url/Azienda.url
Resource
win10-20230915-en
Behavioral task
behavioral4
Sample
url/Azienda.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
url/Cliente.url
Resource
win10-20230915-en
Behavioral task
behavioral6
Sample
url/Cliente.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
url/Documenti.url
Resource
win10-20230915-en
Behavioral task
behavioral8
Sample
url/Documenti.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
url/Informazioni.url
Resource
win10-20230915-en
Behavioral task
behavioral10
Sample
url/Informazioni.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
url/dettagli.url
Resource
win10-20230831-en
Behavioral task
behavioral12
Sample
url/dettagli.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
url/inform.url
Resource
win10-20230915-en
Behavioral task
behavioral14
Sample
url/inform.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
url/modulo.url
Resource
win10-20230915-en
Behavioral task
behavioral16
Sample
url/modulo.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral17
Sample
url/processo.url
Resource
win10-20230915-en
Behavioral task
behavioral18
Sample
url/processo.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral19
Sample
url/sistema.url
Resource
win10-20230915-en
General
-
Target
url/dettagli.url
-
Size
208B
-
MD5
1b903a8fc64800bc3601174a915c7e48
-
SHA1
26441d57d2fa5fc268660dfd894eb066fbda289a
-
SHA256
ee26c22ad61136470226197bd27f757e1f2a4c18b10d33bb6dbeeffceed8ec00
-
SHA512
a625f87c8c328aa18853d8a1ae54952d0459c6c7796b39dde55db3daa2652754e3c8351130acd037a35ebae6f87fca29fb5f7bef3f44973e902ec04dd2da421a
Malware Config
Extracted
gozi
Extracted
gozi
5050
fotexion.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3252 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
rundll32.exepid process 3400 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.execontrol.exerundll32.exedescription pid process target process PID 3400 wrote to memory of 4784 3400 rundll32.exe control.exe PID 3400 wrote to memory of 4784 3400 rundll32.exe control.exe PID 4784 wrote to memory of 4832 4784 control.exe rundll32.exe PID 4784 wrote to memory of 4832 4784 control.exe rundll32.exe PID 4832 wrote to memory of 3252 4832 rundll32.exe rundll32.exe PID 4832 wrote to memory of 3252 4832 rundll32.exe rundll32.exe PID 4832 wrote to memory of 3252 4832 rundll32.exe rundll32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\url\dettagli.url1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV18IXVA\dettagli[1].cpl",2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV18IXVA\dettagli[1].cpl",3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV18IXVA\dettagli[1].cpl",4⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV18IXVA\dettagli[1].cplFilesize
206KB
MD572e2a5c797954e895a41be5b20f867b2
SHA1419aacfb3ccea9b08277bcc9405054fa4238a597
SHA256858d867cc62c0bf13b16ccdb9f6cd6022d61fc2ab98a7db60806a35c7da9b2e0
SHA51277be53cf579f69ee728fafbe93568b8d4c462490ba3fe053db367798508abb0d7a838731d17e465f0a29b982eb49e1227d94c971823e1d375b2b761887e107b3
-
\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV18IXVA\dettagli[1].cplFilesize
206KB
MD572e2a5c797954e895a41be5b20f867b2
SHA1419aacfb3ccea9b08277bcc9405054fa4238a597
SHA256858d867cc62c0bf13b16ccdb9f6cd6022d61fc2ab98a7db60806a35c7da9b2e0
SHA51277be53cf579f69ee728fafbe93568b8d4c462490ba3fe053db367798508abb0d7a838731d17e465f0a29b982eb49e1227d94c971823e1d375b2b761887e107b3
-
memory/3252-6-0x0000000000880000-0x00000000008A9000-memory.dmpFilesize
164KB
-
memory/3252-7-0x0000000000860000-0x000000000086E000-memory.dmpFilesize
56KB
-
memory/3252-8-0x0000000000C50000-0x0000000000C5D000-memory.dmpFilesize
52KB
-
memory/3252-11-0x0000000000860000-0x000000000086E000-memory.dmpFilesize
56KB
-
memory/3252-12-0x0000000000860000-0x000000000086E000-memory.dmpFilesize
56KB