Analysis

  • max time kernel
    121s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-04-2024 23:58

General

  • Target

    Seroxen.exe

  • Size

    12KB

  • MD5

    8208ea3955533b799b0f5f65db02df8a

  • SHA1

    8829745dd294bb94d1dc39266cb2b8c2457b00cd

  • SHA256

    0663f1114eca93d267e0ae9ddbaacf05974d77c0fa95efdf22f23ecbdf8e38cb

  • SHA512

    f9d17761a044ec89490c7727a4cd365f950dd4e5f56762363ea8441fed2a6552036aafc8804fdddf87488148d2e94052e8f94c11dcc36e77d8d047baaf97448a

  • SSDEEP

    192:+3s2rvMWWwghZv1Bsl0csO9qqjKw65dKUmP+eBQ8JG0x/kPo:as27M/zhZNyWjO9H65dDmPVQKdkw

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3300
      • C:\Users\Admin\AppData\Local\Temp\Seroxen.exe
        "C:\Users\Admin\AppData\Local\Temp\Seroxen.exe"
        2⤵
        • Checks computer location settings
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3152
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\applejack1448147.vbs" /f
          3⤵
          • Modifies registry class
          PID:4764
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
          3⤵
          • Modifies registry class
          PID:4956
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C computerdefaults.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:560
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            computerdefaults.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2940
            • C:\Windows\SysWOW64\wscript.exe
              "wscript.exe" C:\Users\Admin\AppData\Local\Temp\applejack1448147.vbs
              5⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:1484
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
                6⤵
                  PID:1448
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN FoxitReaderUpdater_FGHgbhnJDeyD1gGgf050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\FGHgbhnJDeyD1gGgf050MX.exe" /RL HIGHEST /IT
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1212
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Create /SC ONLOGON /TN FoxitReaderUpdater_FGHgbhnJDeyD1gGgf050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\FGHgbhnJDeyD1gGgf050MX.exe" /RL HIGHEST /IT
              4⤵
              • Creates scheduled task(s)
              PID:2284
          • C:\Users\Admin\AppData\Local\Temp\lboc0ncv.exe
            "C:\Users\Admin\AppData\Local\Temp\lboc0ncv.exe" explorer.exe
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3120
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2392 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4556

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Execution

        Scheduled Task/Job

        1
        T1053

        Persistence

        Scheduled Task/Job

        1
        T1053

        Privilege Escalation

        Scheduled Task/Job

        1
        T1053

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Web Service

        1
        T1102

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\5e1a1f161a4f455497770854e5373ed6
          Filesize

          36KB

          MD5

          5deaa13040e111ddb1b0def1692e9681

          SHA1

          62d2ec1f82cd6a42a37d099945679a2a4eb8f96b

          SHA256

          cf87b8a2ef7c58b473051118b1a1deb5d7e21f9bf300e0d20c1992b6ebebcbb5

          SHA512

          8c45f2c3854bd6db1deaba2c5f87d69b484007d2922cd900f5fd79488fddcad820e28a9a2d33cd96be1b0ed144175f209ae0716549ab60fa35a8da0dcd945b06

        • C:\Users\Admin\AppData\Local\Temp\62c18dad0c0f4d22b13b0843049c6c04
          Filesize

          46KB

          MD5

          02d2c46697e3714e49f46b680b9a6b83

          SHA1

          84f98b56d49f01e9b6b76a4e21accf64fd319140

          SHA256

          522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

          SHA512

          60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

        • C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll
          Filesize

          1.4MB

          MD5

          6f2fdecc48e7d72ca1eb7f17a97e59ad

          SHA1

          fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

          SHA256

          70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

          SHA512

          fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

        • C:\Users\Admin\AppData\Local\Temp\applejack1448147.vbs
          Filesize

          171B

          MD5

          a34267102c21aff46aecc85598924544

          SHA1

          77268af47c6a4b9c6be7f7487b2c9b233d49d435

          SHA256

          eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44

          SHA512

          5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

        • C:\Users\Admin\AppData\Local\Temp\ef6697d47e5541ab97e17c9cf4119885
          Filesize

          128KB

          MD5

          94fbd97056c80fa403b2c5229fde6796

          SHA1

          cb9016e8860e3af8d8c97815a71be94d33dee04d

          SHA256

          4cf5e14d554d9f59f96bfe5bf954765de5c5c47f1ca7782a7bf929edaa5ba8af

          SHA512

          ade8641e3156e7750d6770e07e49801e6bcd903457461f7a85acb58da25356c90be68f20372a0e110cdfe8679c99881eeeb9c1d0acfea235b5f872df5519e49e

        • C:\Users\Admin\AppData\Local\Temp\lboc0ncv.exe
          Filesize

          124KB

          MD5

          e898826598a138f86f2aa80c0830707a

          SHA1

          1e912a5671f7786cc077f83146a0484e5a78729c

          SHA256

          df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a

          SHA512

          6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb

        • C:\Users\Admin\AppData\Roaming\Gongle\aHWP8LMSVE\LOG
          Filesize

          331B

          MD5

          4d23c18ccd937bb6bf0f866db6f80d07

          SHA1

          bca94906c9e1c68ba7d765cf04b8a60147e77b37

          SHA256

          d77012c3efa59dbd5db7444f1db7c0c42fdab86c0f2eee5aabe17fbfbe81f0ab

          SHA512

          ecd868d5d40f1a0588a3664bf60dcd2b15c5ba2368a0e98e610748abd1b2175c978a3d59cce86a8575797a2d117c37a25ab2303ea7a45f82acd647173b407416

        • C:\Users\Admin\AppData\Roaming\Gongle\aHWP8LMSVE\LOG.old
          Filesize

          331B

          MD5

          3c1fc56d34b7f53cadd25894e47ab9e1

          SHA1

          f3c71b4394be75915fc5fe11efc0c0f1e42fc32c

          SHA256

          e03f406f35648ff3e39d4746d2dd47e4d15891b42dcd76c71e9aa8a94b268171

          SHA512

          f22dbec590cf4456b1756eccc56407447f053a4d3bac5e16023602befa2f9d3ced6be6543d84718cc401184382013ebf0e1fd65aad3203e480e482590212d628

        • C:\Users\Admin\AppData\Roaming\Gongle\aKYSMJ7ZH7\4s2odj76.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
          Filesize

          48KB

          MD5

          25ff28418b95c9c269e808afc541243a

          SHA1

          fab49d187fc6a3cad1c5f8a104c85aeeb99ea739

          SHA256

          4ac1a451261fefeb103319c2ab8a2c6cc5939cf36e5e4ee69b17fa8433874f69

          SHA512

          a626c22451c06fda6df1e50bacbb4adaced23f34e1a849b5424eeaec7045fdd64def1e2707f15e75094ec92b52bdbb9ebc160eaf3a4551fcfc60fc22bef24bf1

        • C:\Users\Admin\AppData\Roaming\Gongle\aXCION7PYV\CURRENT
          Filesize

          16B

          MD5

          46295cac801e5d4857d09837238a6394

          SHA1

          44e0fa1b517dbf802b18faf0785eeea6ac51594b

          SHA256

          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

          SHA512

          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

        • C:\Users\Admin\AppData\Roaming\Gongle\aXCION7PYV\LOG
          Filesize

          329B

          MD5

          34269408a971d7accecb1d5d381ec3c8

          SHA1

          0597674a6c40b07b473fb59220dcd5c1245177d9

          SHA256

          44a5c9eae54b0724e3cf515ce1e125fe7da89f6030c54fe57a579d3aae474649

          SHA512

          45768e1ea2210070effa1c7662bcaf2b9442b2a44cbd4c94b1662973ee80ce306fb6c86f909a88d9854875cb041c25ab809e43ca2bca981087b5fa01ad9cd450

        • C:\Users\Admin\AppData\Roaming\Gongle\aXCION7PYV\LOG.old
          Filesize

          289B

          MD5

          d849b77287da756d1dbc40976cc66530

          SHA1

          eb21969f8d6f9abcc8a246efc339887f9dba8c69

          SHA256

          4e70e1124b3888853a84aa5b0f28d2c744529f388ef46a79c9518b5c85393eaa

          SHA512

          a75602ba24c002fc45ad3dd53dfdc280a5de93f77119206f06938dd0bb868bce7271f14dbed6f86c67f3f694f67dd0a99ad9e98dacd307298ca2004c096d3e25

        • C:\Users\Admin\AppData\Roaming\Gongle\aXCION7PYV\MANIFEST-000001
          Filesize

          41B

          MD5

          5af87dfd673ba2115e2fcf5cfdb727ab

          SHA1

          d5b5bbf396dc291274584ef71f444f420b6056f1

          SHA256

          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

          SHA512

          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

        • memory/3152-42-0x0000000009C80000-0x0000000009C8A000-memory.dmp
          Filesize

          40KB

        • memory/3152-5-0x00000000053D0000-0x0000000005462000-memory.dmp
          Filesize

          584KB

        • memory/3152-1-0x0000000000450000-0x000000000045C000-memory.dmp
          Filesize

          48KB

        • memory/3152-198-0x000000000AF00000-0x000000000AF0A000-memory.dmp
          Filesize

          40KB

        • memory/3152-2-0x00000000052F0000-0x000000000530A000-memory.dmp
          Filesize

          104KB

        • memory/3152-3-0x00000000054B0000-0x00000000054C0000-memory.dmp
          Filesize

          64KB

        • memory/3152-39-0x0000000006990000-0x00000000069A2000-memory.dmp
          Filesize

          72KB

        • memory/3152-40-0x0000000008F90000-0x0000000008FF6000-memory.dmp
          Filesize

          408KB

        • memory/3152-41-0x0000000007CD0000-0x0000000007CDA000-memory.dmp
          Filesize

          40KB

        • memory/3152-0-0x0000000074F00000-0x00000000756B0000-memory.dmp
          Filesize

          7.7MB

        • memory/3152-44-0x0000000009D00000-0x0000000009D08000-memory.dmp
          Filesize

          32KB

        • memory/3152-43-0x0000000007CC0000-0x0000000007CCC000-memory.dmp
          Filesize

          48KB

        • memory/3152-13-0x0000000013390000-0x0000000014032000-memory.dmp
          Filesize

          12.6MB

        • memory/3152-12-0x00000000054B0000-0x00000000054C0000-memory.dmp
          Filesize

          64KB

        • memory/3152-11-0x0000000074F00000-0x00000000756B0000-memory.dmp
          Filesize

          7.7MB

        • memory/3152-10-0x000000000B1F0000-0x000000000BDF0000-memory.dmp
          Filesize

          12.0MB

        • memory/3152-6-0x0000000005A70000-0x0000000006014000-memory.dmp
          Filesize

          5.6MB

        • memory/3152-184-0x000000000AE60000-0x000000000AE81000-memory.dmp
          Filesize

          132KB

        • memory/3152-4-0x00000000052E0000-0x00000000052EA000-memory.dmp
          Filesize

          40KB

        • memory/3152-172-0x0000000006C70000-0x0000000006D22000-memory.dmp
          Filesize

          712KB

        • memory/3152-173-0x0000000006D80000-0x0000000006DA2000-memory.dmp
          Filesize

          136KB

        • memory/3152-174-0x000000000ACC0000-0x000000000AD36000-memory.dmp
          Filesize

          472KB

        • memory/3152-175-0x0000000009980000-0x000000000999E000-memory.dmp
          Filesize

          120KB

        • memory/3152-176-0x000000000AD40000-0x000000000AD90000-memory.dmp
          Filesize

          320KB

        • memory/3152-177-0x000000000AD90000-0x000000000ADFA000-memory.dmp
          Filesize

          424KB

        • memory/3152-178-0x000000000DDF0000-0x000000000E144000-memory.dmp
          Filesize

          3.3MB

        • memory/3152-179-0x000000000AE00000-0x000000000AE4C000-memory.dmp
          Filesize

          304KB

        • memory/3152-183-0x000000000AEA0000-0x000000000AEDC000-memory.dmp
          Filesize

          240KB

        • memory/3300-29-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
          Filesize

          4KB

        • memory/3300-34-0x0000000002880000-0x0000000002888000-memory.dmp
          Filesize

          32KB

        • memory/3300-32-0x0000000002880000-0x0000000002888000-memory.dmp
          Filesize

          32KB

        • memory/3300-30-0x0000000002880000-0x0000000002888000-memory.dmp
          Filesize

          32KB

        • memory/3300-28-0x0000000002880000-0x0000000002888000-memory.dmp
          Filesize

          32KB