Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 14:43
Static task
static1
Behavioral task
behavioral1
Sample
DATA DPR.exe
Resource
win7-20231129-en
General
-
Target
DATA DPR.exe
-
Size
920KB
-
MD5
a94f55d81f838e77fa3e5187c72e0f95
-
SHA1
72ab38cf2aa50c7358a0faa6d077b91d0898d20d
-
SHA256
f5e56a262514ad5036a1fbe91e3c9ebedf0d874e2d95a91cb7e9693f60d8d33e
-
SHA512
081f71a423a063fc566eba681a47c57bc2248fbcd20b451f6c9ac781c9d5061f89556a878b9559a1d0aa153d8b55610ab27b80ecbadc880eeb3b607d88fb1e8f
-
SSDEEP
24576:AMHDEzlk8VnuAibycLXe3tJACKnHMpxh:AUDEC8puAkW3tJAjnHO
Malware Config
Extracted
gozi
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exeuefidriver.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation uefidriver.exe -
Executes dropped EXE 2 IoCs
Processes:
uefidriver.exeanukxgwb.exepid process 4000 uefidriver.exe 2956 anukxgwb.exe -
Loads dropped DLL 1 IoCs
Processes:
uefidriver.exepid process 4000 uefidriver.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 59 discord.com 24 raw.githubusercontent.com 25 raw.githubusercontent.com 48 discord.com 49 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 55 checkip.amazonaws.com -
Drops file in Windows directory 1 IoCs
Processes:
DATA DPR.exedescription ioc process File created C:\Windows\GameBarPresenceWriter\uefidriver.exe DATA DPR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 7 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\jumpswim47619861.vbs" reg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\shell\open\command reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0" reg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
uefidriver.exeanukxgwb.exepid process 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 2956 anukxgwb.exe 2956 anukxgwb.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe 4000 uefidriver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
uefidriver.exeanukxgwb.exedescription pid process Token: SeDebugPrivilege 4000 uefidriver.exe Token: SeDebugPrivilege 2956 anukxgwb.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
uefidriver.exepid process 4000 uefidriver.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
DATA DPR.execmd.execmd.exeuefidriver.execmd.exeComputerDefaults.exewscript.execmd.exeanukxgwb.exedescription pid process target process PID 3872 wrote to memory of 3412 3872 DATA DPR.exe cmd.exe PID 3872 wrote to memory of 3412 3872 DATA DPR.exe cmd.exe PID 3412 wrote to memory of 4000 3412 cmd.exe uefidriver.exe PID 3412 wrote to memory of 4000 3412 cmd.exe uefidriver.exe PID 3412 wrote to memory of 4000 3412 cmd.exe uefidriver.exe PID 3872 wrote to memory of 3168 3872 DATA DPR.exe cmd.exe PID 3872 wrote to memory of 3168 3872 DATA DPR.exe cmd.exe PID 3168 wrote to memory of 2304 3168 cmd.exe certutil.exe PID 3168 wrote to memory of 2304 3168 cmd.exe certutil.exe PID 3168 wrote to memory of 5088 3168 cmd.exe find.exe PID 3168 wrote to memory of 5088 3168 cmd.exe find.exe PID 3168 wrote to memory of 408 3168 cmd.exe find.exe PID 3168 wrote to memory of 408 3168 cmd.exe find.exe PID 4000 wrote to memory of 1836 4000 uefidriver.exe reg.exe PID 4000 wrote to memory of 1836 4000 uefidriver.exe reg.exe PID 4000 wrote to memory of 1836 4000 uefidriver.exe reg.exe PID 4000 wrote to memory of 384 4000 uefidriver.exe reg.exe PID 4000 wrote to memory of 384 4000 uefidriver.exe reg.exe PID 4000 wrote to memory of 384 4000 uefidriver.exe reg.exe PID 4000 wrote to memory of 2712 4000 uefidriver.exe cmd.exe PID 4000 wrote to memory of 2712 4000 uefidriver.exe cmd.exe PID 4000 wrote to memory of 2712 4000 uefidriver.exe cmd.exe PID 2712 wrote to memory of 4796 2712 cmd.exe ComputerDefaults.exe PID 2712 wrote to memory of 4796 2712 cmd.exe ComputerDefaults.exe PID 2712 wrote to memory of 4796 2712 cmd.exe ComputerDefaults.exe PID 4796 wrote to memory of 2948 4796 ComputerDefaults.exe wscript.exe PID 4796 wrote to memory of 2948 4796 ComputerDefaults.exe wscript.exe PID 4796 wrote to memory of 2948 4796 ComputerDefaults.exe wscript.exe PID 2948 wrote to memory of 3628 2948 wscript.exe cmd.exe PID 2948 wrote to memory of 3628 2948 wscript.exe cmd.exe PID 2948 wrote to memory of 3628 2948 wscript.exe cmd.exe PID 4000 wrote to memory of 2620 4000 uefidriver.exe cmd.exe PID 4000 wrote to memory of 2620 4000 uefidriver.exe cmd.exe PID 4000 wrote to memory of 2620 4000 uefidriver.exe cmd.exe PID 2620 wrote to memory of 1536 2620 cmd.exe schtasks.exe PID 2620 wrote to memory of 1536 2620 cmd.exe schtasks.exe PID 2620 wrote to memory of 1536 2620 cmd.exe schtasks.exe PID 4000 wrote to memory of 2956 4000 uefidriver.exe anukxgwb.exe PID 4000 wrote to memory of 2956 4000 uefidriver.exe anukxgwb.exe PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE PID 2956 wrote to memory of 3416 2956 anukxgwb.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\DATA DPR.exe"C:\Users\Admin\AppData\Local\Temp\DATA DPR.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Windows\GameBarPresenceWriter\uefidriver.exe >nul3⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\GameBarPresenceWriter\uefidriver.exeC:\Windows\GameBarPresenceWriter\uefidriver.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\jumpswim47619861.vbs" /f5⤵
- Modifies registry class
PID:1836 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f5⤵
- Modifies registry class
PID:384 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe5⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe6⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\jumpswim47619861.vbs7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts8⤵PID:3628
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN ZoomAutoUpdater_ZRhrJN2oxBRsd61vu050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\ZRhrJN2oxBRsd61vu050MX.exe" /RL HIGHEST /IT5⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN ZoomAutoUpdater_ZRhrJN2oxBRsd61vu050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\ZRhrJN2oxBRsd61vu050MX.exe" /RL HIGHEST /IT6⤵
- Creates scheduled task(s)
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\anukxgwb.exe"C:\Users\Admin\AppData\Local\Temp\anukxgwb.exe" explorer.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\DATA DPR.exe" MD5 | find /i /v "md5" | find /i /v "certutil"3⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\DATA DPR.exe" MD54⤵PID:2304
-
C:\Windows\system32\find.exefind /i /v "md5"4⤵PID:5088
-
C:\Windows\system32\find.exefind /i /v "certutil"4⤵PID:408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
Filesize
257KB
MD5abba8ce5a4309fa0fb97935796361ed5
SHA15efcc3f4642d3265055e65d122576f784407528b
SHA256afbec8308aeabe6c49a581352cabcd8ae4d6111f9462a4739729b1471dcf2ad5
SHA512a231f98888213daa0011dba8032ac61596e3a424c5c5df05f2a476b1620eda80658fc8233dcad04304701d690121c771bea3299e2c870b4ee09812cc24fe0da6
-
Filesize
8KB
MD54a4c331555f2c8c416032c2644ee82bf
SHA1664c7d30a956929aa31bd0ceeccc997340bb3a0c
SHA2567b638b79e629f9ca330cb955e0bb7204bd1e913926e7bea042832947fce8d094
SHA51295b2e4448ebe14dbc60022d2aa34a9d3126a1b312fe2df5085528e0ef10ca6912f62ed0fbc07c99169325afece6d967ce1648dedd79def6cd96165ff1d79aee8
-
Filesize
1.4MB
MD56f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA25670e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b
-
Filesize
124KB
MD5e898826598a138f86f2aa80c0830707a
SHA11e912a5671f7786cc077f83146a0484e5a78729c
SHA256df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA5126827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
-
Filesize
171B
MD5a34267102c21aff46aecc85598924544
SHA177268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA5125d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3
-
Filesize
331B
MD56fcb3c61f1fb1c551dd7033e8a26ed11
SHA185e3b8f30800fd64181061227bba52184d8908d3
SHA2563089b91c0f2dbd8ce529b569cbc5584eacfbaacb0aa13c87e8db85bdd7a599f5
SHA5122130421dcad9f8e8eed73b3aea72a5ec242cb6cf9234ac0776e4f2c5a9f7a9f611888191f1938eb715acf1c2d48be23eea4c321af91d794e9004dc5625893b26
-
Filesize
293B
MD5f7f8c1015e369ba4dad23a2159f88dd8
SHA1533edb35bb1fe665d096530d14b1efe02427f724
SHA25660d3574016bcabe7e6cbf2c3acb4c7f04d667a59023fbed132c8ad55030b5f1e
SHA512cb99f5077e94c527baf88dbf70d3c6cb0e4e6d05c131c9e9356e7261e5fd1a5ffac6c9398cabb087c0d7ae4c687a145131d8846af94302c6c8c2ecc44072b180
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
329B
MD54ec033fd37e2be9d67b90893c2396851
SHA14f51fb73cb9db2ed4fd8d1214fdaa0ac1315d652
SHA2560a510a2f0e81c541a4bf4fc0c1fa9047088ce8ad10067434e6f43746a95349bd
SHA512dfe123223761ee6838a46b2dae008400151f38eb45e8753aaff7b0e5ebafc9a6035df7a21c72685076db79031ca2a06db3f0db7ec33a31efd89c966f1f3e1a8e
-
Filesize
289B
MD5cd08fad8040fdb427b1805fd03a72638
SHA1cb1ecef5b481609e6396400028dfd99701713d90
SHA256bcd41c32bf8036b87097e6904594e708d48349b0c84ee34bb74c33ed0e8945dd
SHA512c823438321f95135e59daa45b651e1b1300332419cf45823b58319efeafef6aba1d72e3b030340fb27a60e359359c3c53192c294236cec88fec17a45f65335ae
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Roaming\Gongle\aN80OHUIG5\e6zhegwu.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Filesize48KB
MD53ec2634ea28476387003685fa6ef29f9
SHA19d3dc64ba92eaa78843690fd7b503acdbeac06cf
SHA2561e3f4345c82c1d62f41c052cefa66e4eeb6d05e611c03a4e29b12e9b3bb2d2fc
SHA512b37ca94b1413dff0f3e55b50692dafc9bfd0d98a7fd5d1a3934ac889dd6e97b24d0181bb8c0d6e006ce3899ce4823367e20cdbb9068ce022e14922cebdfb6cc6
-
Filesize
12KB
MD5fab7d20b6a4ea57bb75c04223bc967a4
SHA10274ada30fe0929c5048a21e562f52d5b31adcfc
SHA256053006923f1503fbf9f6163423e7a4c7ac05108bed2c2ade0329ff2b09b5e00f
SHA5124fdfe4f34fd3d5a728a0bde44cd758811bbba8ae0f67d0cf2a38197fb725786a02b360de0c43af31775e7c4fe1b3d8093aa1feb1a65223c631c31e3fd6b0d497