Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 21:31
Static task
static1
Behavioral task
behavioral1
Sample
easfawefawfas.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
easfawefawfas.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
easfawefawfas.exe
Resource
win10v2004-20240426-en
General
-
Target
easfawefawfas.exe
-
Size
12KB
-
MD5
2813b6e3ed4bd6b14c53e3dffcdff21d
-
SHA1
5ac7c7a3dadde70f94810c608a2eb275f14b7bde
-
SHA256
866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
-
SHA512
ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24
-
SSDEEP
192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo
Malware Config
Extracted
gozi
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
easfawefawfas.exewscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation easfawefawfas.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
fbuigfpg.exepid process 4632 fbuigfpg.exe -
Loads dropped DLL 1 IoCs
Processes:
easfawefawfas.exepid process 2544 easfawefawfas.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 14 raw.githubusercontent.com 15 raw.githubusercontent.com 41 discord.com 42 discord.com 48 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 44 checkip.amazonaws.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 7 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\ms-settings\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\consoleitaly1826.vbs" reg.exe Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\ms-settings\shell\open\command reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0" reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
easfawefawfas.exefbuigfpg.exepid process 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 4632 fbuigfpg.exe 4632 fbuigfpg.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe 2544 easfawefawfas.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
easfawefawfas.exefbuigfpg.exedescription pid process Token: SeDebugPrivilege 2544 easfawefawfas.exe Token: SeDebugPrivilege 4632 fbuigfpg.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
easfawefawfas.exepid process 2544 easfawefawfas.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3452 Explorer.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
easfawefawfas.execmd.exeComputerDefaults.exewscript.execmd.exefbuigfpg.exedescription pid process target process PID 2544 wrote to memory of 4836 2544 easfawefawfas.exe reg.exe PID 2544 wrote to memory of 4836 2544 easfawefawfas.exe reg.exe PID 2544 wrote to memory of 4836 2544 easfawefawfas.exe reg.exe PID 2544 wrote to memory of 2080 2544 easfawefawfas.exe reg.exe PID 2544 wrote to memory of 2080 2544 easfawefawfas.exe reg.exe PID 2544 wrote to memory of 2080 2544 easfawefawfas.exe reg.exe PID 2544 wrote to memory of 1316 2544 easfawefawfas.exe cmd.exe PID 2544 wrote to memory of 1316 2544 easfawefawfas.exe cmd.exe PID 2544 wrote to memory of 1316 2544 easfawefawfas.exe cmd.exe PID 1316 wrote to memory of 5084 1316 cmd.exe ComputerDefaults.exe PID 1316 wrote to memory of 5084 1316 cmd.exe ComputerDefaults.exe PID 1316 wrote to memory of 5084 1316 cmd.exe ComputerDefaults.exe PID 5084 wrote to memory of 2012 5084 ComputerDefaults.exe wscript.exe PID 5084 wrote to memory of 2012 5084 ComputerDefaults.exe wscript.exe PID 5084 wrote to memory of 2012 5084 ComputerDefaults.exe wscript.exe PID 2012 wrote to memory of 4900 2012 wscript.exe cmd.exe PID 2012 wrote to memory of 4900 2012 wscript.exe cmd.exe PID 2012 wrote to memory of 4900 2012 wscript.exe cmd.exe PID 2544 wrote to memory of 640 2544 easfawefawfas.exe cmd.exe PID 2544 wrote to memory of 640 2544 easfawefawfas.exe cmd.exe PID 2544 wrote to memory of 640 2544 easfawefawfas.exe cmd.exe PID 640 wrote to memory of 3604 640 cmd.exe schtasks.exe PID 640 wrote to memory of 3604 640 cmd.exe schtasks.exe PID 640 wrote to memory of 3604 640 cmd.exe schtasks.exe PID 2544 wrote to memory of 4632 2544 easfawefawfas.exe fbuigfpg.exe PID 2544 wrote to memory of 4632 2544 easfawefawfas.exe fbuigfpg.exe PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE PID 4632 wrote to memory of 3452 4632 fbuigfpg.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs" /f3⤵
- Modifies registry class
PID:4836 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
- Modifies registry class
PID:2080 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts6⤵PID:4900
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT3⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT4⤵
- Creates scheduled task(s)
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\fbuigfpg.exe"C:\Users\Admin\AppData\Local\Temp\fbuigfpg.exe" explorer.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
Filesize
8KB
MD544f589a9b9f5aec7c75a00a41f1a80f7
SHA17e109ef217a90c80382927b04c0e64691cdd4617
SHA256f7ade73e260d3c61af25254f9e82567c702c7a7793c84cba4db9c6216da488e8
SHA51241a479139ad3df24e52398f5220684a8e337dcdbc672f4869b280983ab7ea86e17257a34b6a05e9e0b53e033202ea33d1d3386e17f4eda3ad82569fb8880eeea
-
Filesize
1.4MB
MD56f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA25670e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b
-
Filesize
130KB
MD52129c93ebef1847ad5862ee0609711f2
SHA1bc2ace652aeec4266d528ad13a76fd039fc1f842
SHA25611ba339ca70746197e5c0d6cfe59809de74ec52d0c0839d7cfa9abc110e04f2f
SHA512b7f41ed58c03d1c180ccf136c56df1474934ad70a6d8db9998c985142ba70dbbb14f1085ff475f01da1b58e114e0fbc3fc8b35f007dd67ac9e7282168ced4429
-
Filesize
171B
MD5a34267102c21aff46aecc85598924544
SHA177268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA5125d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3
-
Filesize
124KB
MD5e898826598a138f86f2aa80c0830707a
SHA11e912a5671f7786cc077f83146a0484e5a78729c
SHA256df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA5126827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
-
C:\Users\Admin\AppData\Roaming\Gongle\a4J4DJQUJB\ntkangc5.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Filesize48KB
MD57725f240150bf79097f33e7d651c238b
SHA1702156cda11eab85b24b930671b6ed66b6c48767
SHA2564fe6c41f0a0ea1031cf906d460c415a87cb9ba0a563e90f52dd95a5578dd501e
SHA5129f2268c34a235ed4964a5c757eec046e242ea1957dfe1505a02c9f3c798083669dbba9c4d70376ffe5618bf0626bd14659d97909e40faa158f2102d39f9fe329
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
332B
MD57f83941ed9800b04c69f392f43ca7c18
SHA1dca6f2d922f3b741d04f3a873a1f29c6cdb36778
SHA25626520a52c894023569d7a576325456bc058becc6c6f52cf8ec62552bfb20424a
SHA512b2ecf51386b3d64eeacea12b9c2a781dc9a6bfbb23ad96e43060696ec72e23435065177fbbaa68eb40586919434de632ab189f0377ea3ac1a1c9514d8d4277b8
-
Filesize
289B
MD53d7543dc06a8033cd207d8418dcf70cd
SHA15dbbc6dc403184fb4a47e28fb485063fe9315563
SHA2566e3d81dd0a5455776008a354108710224d131766b16bd1dd07ef99d6a33cb98f
SHA512344b7d8218ef664a892a030ab9b54dad0335dcefe0022353c5093e6789131aa1bff5aaa00d4b74c7536b0d8251213109bbbddd559afbb36da456946176574b55
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
331B
MD52e66d733c7e935f87a7bfbbdceb80bcc
SHA104a42431b919b013879d8adc753acdd64d4eac6f
SHA2562eb6ca475812326fa22a50085d9e3da4d82dbf4909fb6b4d5e722dcb3a1d1465
SHA512c8a889e50e17fc4b2e37de927d7b2153347f6f3ac6262b65771d85ee47f08c4d0f619a2be9bd55c2145cf77f7c4cdad91c04ffdd2ef253564098a94711f93731
-
Filesize
293B
MD50545d619d52fef4b267c8fad555c758c
SHA143229585bec768c70b0f18cb920a89e82be53d0b
SHA25624f6d34f149200bc74432b87836f175bb80a56e75ba073f4bae51c7d7dbd37f6
SHA5120520f0a10bb1d38b766dd2e566ba8ab9e1dda5d4ffc620b9e8258a7e288b41ed109eac06b11f1378c72fb2b35d6a56b91910681258a6b3a3a0aff63fe1778c69