Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
30-05-2024 21:46
General
-
Target
easfawefawfas.exe
-
Size
12KB
-
MD5
2813b6e3ed4bd6b14c53e3dffcdff21d
-
SHA1
5ac7c7a3dadde70f94810c608a2eb275f14b7bde
-
SHA256
866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
-
SHA512
ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24
-
SSDEEP
192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo
Malware Config
Extracted
gozi
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs" /f3⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts6⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT4⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\ly3tilrf.exe"C:\Users\Admin\AppData\Local\Temp\ly3tilrf.exe" explorer.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
Filesize
8KB
MD506cf2fa7b0dc9c9c47e228a02447a137
SHA1666d6730bb0a8687b1ffb86d8584886da94b8343
SHA2567717ffaf72b118e2cc26c59bd760505012b9db6134eb8d0e2da71a04a634d7cd
SHA5128a513ee4be32cc5c9cc70115b134d6f47a137807694861b9b5fe0458a7b429caa664685a33d5bb0a7d83abf72d69a896e0e64880d4379c85efc1121634a4f625
-
Filesize
1.4MB
MD56f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA25670e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b
-
Filesize
171B
MD5a34267102c21aff46aecc85598924544
SHA177268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA5125d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3
-
Filesize
130KB
MD5771d0c138e8b941d06e9b69df07d63f6
SHA1deecf342dc737139b1fc214e2093070746891514
SHA2561723553bf7499d44753de432e33395374c8c480c58de210f75e0880d7dc47d6d
SHA512cbc7bade43eda179203b3e076781f5aa50b30e891ee7ed8c269f0ac49f8d4fe3b5dd354b55d738cb8765a25e83760b8785341a15f4d3cfcff15a5b52f7306307
-
Filesize
124KB
MD5e898826598a138f86f2aa80c0830707a
SHA11e912a5671f7786cc077f83146a0484e5a78729c
SHA256df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA5126827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
-
Filesize
334B
MD5f1a6028daa4c03c8c4b5cf7706e87a5e
SHA1337f8854109a6c73fd8d8e6b21f40b10e05172d9
SHA256d0b60c0ad07234c2403123bbcdba9d97bd96131925eed6ac4a2e54b09edd3b24
SHA512263d2f5acfdcd79051b4af58552c09d4ad3c5d455c6dba52504d404baa8312e5954e63d819e86af8da8335e1577fad8989bb4d76ab40b1729fb0ec1d41e44bfa
-
Filesize
293B
MD57111d89f55958cb146c66e36824c8a68
SHA1d0a625831151415994cc9e95c8471a6724e52264
SHA256e74c07a448772ae5d8030c6f1550214a736554016f9f0f1f8d77a9c72fbe7afe
SHA512e989ceac045709f95f3842a29489676b34f314a297cda77d18f9e105bc9ead2fe5c6db84827b3efe8fe59f33345c5c5e2a11c0b7ed220cfe8b9a85a880907f8d
-
Filesize
48KB
MD5153d58ff42ed567a976c3f943c85740e
SHA12ebbc8e725d577de17dd4f73dc80e17c2a03bbd8
SHA256e3e69c2ec78ab1badf3ec3ab07881b0db10dacebbac039c1032a76a67fb806cf
SHA512068f79604ae83bf657603c57ac786f2ccc1a465776101ab15dbcc28ec0888cdc1c61d4d40a0b0ae22c32c60becd354588ef960220946c2f7f9f119d55cfc6037
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
329B
MD5bcf80c4d095c756f0c1e715006580574
SHA17ca0dd22cab28fa2d7df7c6b7bf0baeb59045825
SHA256d53c67c42dbe13c39b48e7722f7db2c8857f679ebbaf6e883f4d2f934855c491
SHA512c8de3c76190fc9428e444299d2b08c4a2f0e3122eba94ba267b2097f02c0feac672ddf74518712f1dba791b88d680ebed0a8c61f3970efe9308a9e8eede1d988
-
Filesize
289B
MD55ee6d573e642ac311660b21956c808c2
SHA1ff7f443e5ad99e149a4e96e486ebc84a31a07f8e
SHA2564a4c118590de7499ab75e2218b823f5c75a97a32c51bf3449bc20fea9f48bad2
SHA51235d9a49ae603519717eb90bab24a8bcbb24eabeb2db83bdaa5cc4853a1c91f715f66743d22d75033c3d4763f1e91d0265a22287e12c739fa774c261727792106
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
712KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
12.6MB
-
Filesize
12.0MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
136KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
320KB
-
Filesize
424KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
132KB
-
Filesize
40KB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
48KB