Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 03:43
Static task
static1
Behavioral task
behavioral1
Sample
0d527534100ddb9ef3e08ead858fabab.dll
Resource
win7-20231129-en
General
-
Target
0d527534100ddb9ef3e08ead858fabab.dll
-
Size
378KB
-
MD5
0d527534100ddb9ef3e08ead858fabab
-
SHA1
fd105a90d7a754c3965bd4a81e01cafb84ddc44b
-
SHA256
86928e68c8e3b874d89b490e55de47171f0350ead784fe09589a031adade2271
-
SHA512
8929ed92cf224237cc3783e3ba23a89ea8ddad5d0d61c48e2f1432fb355c21fece875cd76f9fdbc98e7f1ac0d4b565ff73a1be534880d59381f47116d7778d02
-
SSDEEP
6144:NAqX6GBMYdZdpfkmGjwSgF8H3V6Uclz5wdL5FczVN877v4FOH/:N5qQdZrkmGs58H3k/h5wdL5OVN877aG
Malware Config
Extracted
gozi
Extracted
gozi
1500
app.buboleinov.com
chat.veminiare.com
chat.billionady.com
app3.maintorna.com
-
build
250188
-
exe_type
loader
-
server_id
580
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8B09A31-A74D-11EE-8459-F62A48C4CCA6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000d448f22139673250dc22385c045fcc6cc68c0b9fc8d4698a311d615da1c585d6000000000e8000000002000020000000d5feb1e094c9b32ff8100246025687c78b567c3c91d46c92cd4b64d24e4fa3e2200000008868927095ad7993e8609e5e8f75f571c9df848a98ddc7d80641f9deca51055640000000286f45c360efa698b6e1bb8ae09d55fbb9f93f370dc84fc35995bbfc7a5a058ffcc6664627edc6ce661b3abd6fb7b40ae42b539f400b7fc16af19e9f48b8ea7e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001f5a8d5a3bda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000bbf2c5a6104630b17f5d99e2874f3ddc987d0dc221e820374a2c1a2b767018f1000000000e80000000020000200000009ee00d10b79937b82cf3d54e56989622206db1e4c50c6675aafc21ca2be29e7590000000f12cceada39549c84b249378569ecb538650b2f7a88b9b75fc3846041ff38c813640fbc212bffd815457fd18ebd3c9f615daed99550f14fcb2d1df5cf59b8782e832f2763b43538ca0b92fb62bb19b003e20c14c05a6bc699538b0808fa32629b0f1d0bf889d9abb65a05e508a7f8e78f5a9f671eac41f8ad7f7e228a2d95980a290f6520d651e92c3c6e5020ff2a02740000000117aa00e0e87719397fe550da320077d0938ca7191d0e6f6be1d8252492d64d5202336843e5448e26e852787f9ccc360f95a797fdddc0ff54ceb6e04589ab488 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1588 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1588 iexplore.exe 1588 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exeiexplore.exedescription pid process target process PID 2924 wrote to memory of 2988 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2988 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2988 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2988 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2988 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2988 2924 rundll32.exe rundll32.exe PID 2924 wrote to memory of 2988 2924 rundll32.exe rundll32.exe PID 1588 wrote to memory of 2712 1588 iexplore.exe IEXPLORE.EXE PID 1588 wrote to memory of 2712 1588 iexplore.exe IEXPLORE.EXE PID 1588 wrote to memory of 2712 1588 iexplore.exe IEXPLORE.EXE PID 1588 wrote to memory of 2712 1588 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d527534100ddb9ef3e08ead858fabab.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d527534100ddb9ef3e08ead858fabab.dll,#12⤵PID:2988
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1588 CREDAT:275457 /prefetch:21⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
252B
MD5c70575350c785f7231e6529b64551e3f
SHA1dd83409aad13916cdfc86ea94dd30f2ff1ab418d
SHA256ec8c46d05f564f96374f899ad7204f038afc82fe544bdc61c682dd4cf238388f
SHA5128bc35259956194db5f7ab8e55b658d9ca4ed53492fde47f9fcd35b1051144bbb5ee1ba23f4ff8328b67f41ce4c706e5d3c46f6ab233ac2d2fb3367b1c5095e25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD51aed5817119300fe538852c8851f619a
SHA14d2b6140aeb0f24f8bfb085dbbea30e252a1747d
SHA2567ea29ff3dd76cbc6473d402044ae3204565be12a39b8835d5ae41943f37479e8
SHA512906adea07c3e78e067520592d732f5a38131de3a33bc87fdce058eb0be6bd54f789173ebbbe6f174bbb2ee2d78a22441886832414183e10da3ccc4248bb82a18
-
C:\Users\Admin\AppData\Local\Temp\TarF4D0.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
memory/2988-3-0x00000000726B0000-0x000000007371D000-memory.dmpFilesize
16.4MB
-
memory/2988-13-0x0000000000210000-0x0000000000212000-memory.dmpFilesize
8KB
-
memory/2988-9-0x00000000726B0000-0x000000007371D000-memory.dmpFilesize
16.4MB
-
memory/2988-6-0x00000000001D0000-0x00000000001DD000-memory.dmpFilesize
52KB
-
memory/2988-0-0x00000000726B0000-0x000000007371D000-memory.dmpFilesize
16.4MB
-
memory/2988-2-0x00000000726B0000-0x000000007371D000-memory.dmpFilesize
16.4MB
-
memory/2988-1-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB