Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
30/05/2024, 21:46
General
-
Target
easfawefawfas.exe
-
Size
12KB
-
MD5
2813b6e3ed4bd6b14c53e3dffcdff21d
-
SHA1
5ac7c7a3dadde70f94810c608a2eb275f14b7bde
-
SHA256
866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
-
SHA512
ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24
-
SSDEEP
192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo
Malware Config
Extracted
gozi
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs" /f3⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts6⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT4⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\3afowfiq.exe"C:\Users\Admin\AppData\Local\Temp\3afowfiq.exe" explorer.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5e898826598a138f86f2aa80c0830707a
SHA11e912a5671f7786cc077f83146a0484e5a78729c
SHA256df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA5126827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
-
Filesize
8KB
MD52a8421131824a534dedcb3ffb2a9b521
SHA1db8684cc28987aed8a0cf2abc71d3736fd6dec18
SHA2561ed4417eb1e8ff607266b264b002dc0dfc4bd814efdff163ffe915ccf18a87ba
SHA512b7211ff0b479f578cdeda38bc968ead63cafc6abc75b7f4384bdc8e8b587e67cac3e6bed6a2b1b19c4aef399707b2306112aa1196d5493c35b89f4ffa8c5ed80
-
Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
Filesize
1.4MB
MD56f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA25670e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b
-
Filesize
171B
MD5a34267102c21aff46aecc85598924544
SHA177268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA5125d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3
-
Filesize
130KB
MD53094acc12a2e7459c8910f01190b73f4
SHA198de14c108d4424d9ad4a1328e44ab627140b2ce
SHA256cadc46a662d673ac9a49901771a8b9cb02996cb1c353e7c266a3df73b7b7d625
SHA5129e19e4629ac19a9f6b6282c91d3238aa6bf5ea21dc5dffe5a5a7ecc03d758d48c10de8b7f01e233f58516eb01bedc52d08ebd410372ff9536b944e5822e2eb80
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
332B
MD5db7de3d7077d14ec5022bdb9c2684158
SHA1f27c7e8bfaf7c526990d971eec962ee714d63b1f
SHA256d1fba53d3f89d5efe3837d8cad4551b9774e73e0b1967ed0b204cd7abfc39a3c
SHA5129e6ab6dcca1813d4808a5c7d6989642ed1eaf4bd88b0fa0a736c798a7d345ada27586d49d3b86c8901d44b82a4a49fa3e74c127846b74778716621754b40d544
-
Filesize
289B
MD5069e4a217190d6cb62860b48f40df265
SHA129951438604029ddcbf69f5e5336ec3389e30396
SHA256ee6d40510ba91172380f180e8a9bd6203b4f69fa6e7cf9d7cf29c0f106536d98
SHA51286a29efcf4813649b657af86227906d78ccfab879d98f8ece54407dc576108d81f7dfdf214c67a3764ec4cee78ac9cdec6bf9922b61e6b0b401ca098a76cc8ef
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
331B
MD58e12bf1ea0d634fff9c409b6b7786c70
SHA1345fb1ce5c14078e514dc1b91a45098c31f9d10b
SHA256117ad27ccee9d3f4ac6fa0fd481ab16f532519c97be84a2fe77b3a3d91c6bc0f
SHA51268d7e5d2c738ae4e0c74dfc11bafef16a73ccb5f9213890ee0d31dee7b25bc40de41b08c47fc74f42a25e91dcf2d0c701753931e37959215d6dc711d086aad44
-
Filesize
293B
MD55a39c029e16d496bf123d83d2e5225fb
SHA151a91741fed8527f1817f0785fe5f551cb1b427f
SHA2564fd0f638ce5670f768eb9a0b55beeb2dd79da741d9280c54bf574fd66a08f6af
SHA51225eb87f7f84d1704554bd432be53ce1f3080ed9eed8aee900963250982f55161ed37ae9440971274f7a4f6eaf68fb71467dcf9c0a658417ad2bbf11aba3e00d1
-
Filesize
48KB
MD566b205f04679b5f82c9ee9472f099446
SHA191108f3dd5250bcadfe377462f28eaaf93b10c27
SHA25657ba14a574b090a73ae86ced20545d87a04c7da16cb9a1eb5c171ffe11233468
SHA512aabe92889ceead8c6422833ed42b430d452aa5a5d12975048538b34bcf4c6bdaeb02d7491b5a31cd3102598ae2683556e60e25f33ccdbc1cf4453e65dc5e1ec4
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
712KB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
12.6MB
-
Filesize
12.0MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
136KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
584KB
-
Filesize
320KB
-
Filesize
424KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
132KB
-
Filesize
40KB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
48KB