Overview
overview
10Static
static
1url/Ammini...ne.url
windows10-1703-x64
10url/Ammini...ne.url
windows10-2004-x64
10url/Azienda.url
windows10-1703-x64
10url/Azienda.url
windows10-2004-x64
10url/Cliente.url
windows10-1703-x64
10url/Cliente.url
windows10-2004-x64
10url/Documenti.url
windows10-1703-x64
10url/Documenti.url
windows10-2004-x64
10url/Informazioni.url
windows10-1703-x64
10url/Informazioni.url
windows10-2004-x64
10url/dettagli.url
windows10-1703-x64
10url/dettagli.url
windows10-2004-x64
10url/inform.url
windows10-1703-x64
10url/inform.url
windows10-2004-x64
10url/modulo.url
windows10-1703-x64
10url/modulo.url
windows10-2004-x64
10url/processo.url
windows10-1703-x64
10url/processo.url
windows10-2004-x64
10url/sistema.url
windows10-1703-x64
10url/sistema.url
windows10-2004-x64
10Analysis
-
max time kernel
146s -
max time network
159s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
13-10-2023 01:40
Static task
static1
Behavioral task
behavioral1
Sample
url/Amministrazione.url
Resource
win10-20230915-en
Behavioral task
behavioral2
Sample
url/Amministrazione.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
url/Azienda.url
Resource
win10-20230915-en
Behavioral task
behavioral4
Sample
url/Azienda.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
url/Cliente.url
Resource
win10-20230915-en
Behavioral task
behavioral6
Sample
url/Cliente.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
url/Documenti.url
Resource
win10-20230915-en
Behavioral task
behavioral8
Sample
url/Documenti.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
url/Informazioni.url
Resource
win10-20230915-en
Behavioral task
behavioral10
Sample
url/Informazioni.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
url/dettagli.url
Resource
win10-20230831-en
Behavioral task
behavioral12
Sample
url/dettagli.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
url/inform.url
Resource
win10-20230915-en
Behavioral task
behavioral14
Sample
url/inform.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
url/modulo.url
Resource
win10-20230915-en
Behavioral task
behavioral16
Sample
url/modulo.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral17
Sample
url/processo.url
Resource
win10-20230915-en
Behavioral task
behavioral18
Sample
url/processo.url
Resource
win10v2004-20230915-en
Behavioral task
behavioral19
Sample
url/sistema.url
Resource
win10-20230915-en
General
-
Target
url/processo.url
-
Size
208B
-
MD5
e98e3a495a146d3048f39c08706a0755
-
SHA1
ddcda25154570cd1fd9a0932dbb64d8768cac86a
-
SHA256
b4ff46c2f843a1f69b7ffae5efa6a1821bc6f8ebca5d52e91792f40bcc2933f0
-
SHA512
7b2ec42a75113277139763aa64fa288b2353a7a20423757dbd8136a75ac087ed0064620c4811a70acc0e5c1920fa5c056252de937430da65dde7124d16a8fc0c
Malware Config
Extracted
gozi
Extracted
gozi
5050
fotexion.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 14 2252 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2252 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000_Classes\Local Settings rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
rundll32.exepid process 2076 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.execontrol.exerundll32.exedescription pid process target process PID 2076 wrote to memory of 1472 2076 rundll32.exe control.exe PID 2076 wrote to memory of 1472 2076 rundll32.exe control.exe PID 1472 wrote to memory of 4744 1472 control.exe rundll32.exe PID 1472 wrote to memory of 4744 1472 control.exe rundll32.exe PID 4744 wrote to memory of 2252 4744 rundll32.exe rundll32.exe PID 4744 wrote to memory of 2252 4744 rundll32.exe rundll32.exe PID 4744 wrote to memory of 2252 4744 rundll32.exe rundll32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\url\processo.url1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9TVXN1W7\processo[1].cpl",2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9TVXN1W7\processo[1].cpl",3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9TVXN1W7\processo[1].cpl",4⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9TVXN1W7\processo[1].cplFilesize
206KB
MD572e2a5c797954e895a41be5b20f867b2
SHA1419aacfb3ccea9b08277bcc9405054fa4238a597
SHA256858d867cc62c0bf13b16ccdb9f6cd6022d61fc2ab98a7db60806a35c7da9b2e0
SHA51277be53cf579f69ee728fafbe93568b8d4c462490ba3fe053db367798508abb0d7a838731d17e465f0a29b982eb49e1227d94c971823e1d375b2b761887e107b3
-
\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9TVXN1W7\processo[1].cplFilesize
206KB
MD572e2a5c797954e895a41be5b20f867b2
SHA1419aacfb3ccea9b08277bcc9405054fa4238a597
SHA256858d867cc62c0bf13b16ccdb9f6cd6022d61fc2ab98a7db60806a35c7da9b2e0
SHA51277be53cf579f69ee728fafbe93568b8d4c462490ba3fe053db367798508abb0d7a838731d17e465f0a29b982eb49e1227d94c971823e1d375b2b761887e107b3
-
memory/2252-6-0x0000000003250000-0x0000000003279000-memory.dmpFilesize
164KB
-
memory/2252-7-0x0000000003290000-0x000000000329E000-memory.dmpFilesize
56KB
-
memory/2252-8-0x0000000003590000-0x000000000359D000-memory.dmpFilesize
52KB
-
memory/2252-11-0x0000000003290000-0x000000000329E000-memory.dmpFilesize
56KB