Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-05-2024 21:50
Static task
static1
Behavioral task
behavioral1
Sample
easfawefawfas.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
easfawefawfas.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
easfawefawfas.exe
Resource
win10v2004-20240508-en
General
-
Target
easfawefawfas.exe
-
Size
12KB
-
MD5
2813b6e3ed4bd6b14c53e3dffcdff21d
-
SHA1
5ac7c7a3dadde70f94810c608a2eb275f14b7bde
-
SHA256
866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
-
SHA512
ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24
-
SSDEEP
192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo
Malware Config
Extracted
gozi
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
exeatjwc.exepid process 3976 exeatjwc.exe -
Loads dropped DLL 1 IoCs
Processes:
easfawefawfas.exepid process 2984 easfawefawfas.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 3 raw.githubusercontent.com 6 discord.com 7 discord.com 11 discord.com 1 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 checkip.amazonaws.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 7 IoCs
Processes:
reg.exereg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0" reg.exe Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\ms-settings\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\consoleitaly1826.vbs" reg.exe Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\ms-settings\shell\open\command reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
easfawefawfas.exeexeatjwc.exepid process 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 3976 exeatjwc.exe 3976 exeatjwc.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe 2984 easfawefawfas.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
easfawefawfas.exeexeatjwc.exedescription pid process Token: SeDebugPrivilege 2984 easfawefawfas.exe Token: SeDebugPrivilege 3976 exeatjwc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
easfawefawfas.exepid process 2984 easfawefawfas.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
easfawefawfas.execmd.exeComputerDefaults.exewscript.execmd.exeexeatjwc.exedescription pid process target process PID 2984 wrote to memory of 2752 2984 easfawefawfas.exe reg.exe PID 2984 wrote to memory of 2752 2984 easfawefawfas.exe reg.exe PID 2984 wrote to memory of 2752 2984 easfawefawfas.exe reg.exe PID 2984 wrote to memory of 1548 2984 easfawefawfas.exe reg.exe PID 2984 wrote to memory of 1548 2984 easfawefawfas.exe reg.exe PID 2984 wrote to memory of 1548 2984 easfawefawfas.exe reg.exe PID 2984 wrote to memory of 3300 2984 easfawefawfas.exe cmd.exe PID 2984 wrote to memory of 3300 2984 easfawefawfas.exe cmd.exe PID 2984 wrote to memory of 3300 2984 easfawefawfas.exe cmd.exe PID 3300 wrote to memory of 4044 3300 cmd.exe ComputerDefaults.exe PID 3300 wrote to memory of 4044 3300 cmd.exe ComputerDefaults.exe PID 3300 wrote to memory of 4044 3300 cmd.exe ComputerDefaults.exe PID 4044 wrote to memory of 1428 4044 ComputerDefaults.exe wscript.exe PID 4044 wrote to memory of 1428 4044 ComputerDefaults.exe wscript.exe PID 4044 wrote to memory of 1428 4044 ComputerDefaults.exe wscript.exe PID 1428 wrote to memory of 2876 1428 wscript.exe cmd.exe PID 1428 wrote to memory of 2876 1428 wscript.exe cmd.exe PID 1428 wrote to memory of 2876 1428 wscript.exe cmd.exe PID 2984 wrote to memory of 3044 2984 easfawefawfas.exe cmd.exe PID 2984 wrote to memory of 3044 2984 easfawefawfas.exe cmd.exe PID 2984 wrote to memory of 3044 2984 easfawefawfas.exe cmd.exe PID 3044 wrote to memory of 3504 3044 cmd.exe schtasks.exe PID 3044 wrote to memory of 3504 3044 cmd.exe schtasks.exe PID 3044 wrote to memory of 3504 3044 cmd.exe schtasks.exe PID 2984 wrote to memory of 3976 2984 easfawefawfas.exe exeatjwc.exe PID 2984 wrote to memory of 3976 2984 easfawefawfas.exe exeatjwc.exe PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE PID 3976 wrote to memory of 3244 3976 exeatjwc.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs" /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\exeatjwc.exe"C:\Users\Admin\AppData\Local\Temp\exeatjwc.exe" explorer.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\38b11884b17e488ebd9b9f975c017f79Filesize
8KB
MD502ef0f562bbce207300bccf202ff6e2c
SHA10cf0b67a0b963aed15703d24cedb447a601b08e8
SHA2563969a30cfd6ac5fd89d636e3094f10e02c2165e21a20500a30d33b834da10198
SHA512f31b44d5a2456e9e98cbd587c839beab31da4c8f9f97780c87dda938e58088ff2b7eb295d8e50ad6154337eccc02ba0ee4842064f88986e63a55262eb5d732fc
-
C:\Users\Admin\AppData\Local\Temp\54fb90e650274daa99b90b91da92a9e5Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dllFilesize
1.4MB
MD56f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA25670e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b
-
C:\Users\Admin\AppData\Local\Temp\b11ddca12e2e4a78858af774671fdeccFilesize
130KB
MD5347f6c84258c09012080425bf04e25bc
SHA16768b8aa677a01137a47a5eff517c53a158aa23a
SHA256d433c36d55b70fc0efac8ae375bb45dc0958786ea0709f411be3c1bd19c5ec28
SHA512efb104520b3638695d58676e84dbff3bf7da5c3f72e0e9179956956c42fd2145679ae892fbeb53f847f11852fbb3fc00366ed9ccd9fa71d3b2e33c58f668e859
-
C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbsFilesize
171B
MD5a34267102c21aff46aecc85598924544
SHA177268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA5125d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3
-
C:\Users\Admin\AppData\Local\Temp\exeatjwc.exeFilesize
124KB
MD5e898826598a138f86f2aa80c0830707a
SHA11e912a5671f7786cc077f83146a0484e5a78729c
SHA256df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA5126827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
-
C:\Users\Admin\AppData\Roaming\Gongle\aASTN7O80X\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Roaming\Gongle\aASTN7O80X\LOGFilesize
329B
MD5e2421de617787e370c383524952bbe8c
SHA1b898cb4fc7a155455d28366ccd4307ddc7232b42
SHA25661e01c91ae1f102eb7b0287688c2b3b05005b713b65a05363a634cdfcbc43588
SHA5123f1bc9e4d6e1d98b50fa0b8efde202ecd7be524f978034c14380b2a29d38a0fa141887dc200fd887700c4cac38ce9b85e638bba62d63ea641ef9e48074d85f75
-
C:\Users\Admin\AppData\Roaming\Gongle\aASTN7O80X\LOG.oldFilesize
289B
MD5ebe702b68644214cf2692e840fe4f5cb
SHA1a70483536d90fb8f30d2d9dc8aa7b3375e6d5de0
SHA256b25011bd9729a00d529e2658324fb0fab9b562c69b3a3ec38a288c8a5ea0d075
SHA512d07ec63ed2e108a350c4ba09aca6211ff80aa361425a94d3c155901a380734c394558b852b1271f952c57f3e0befa46824a1f4f68dba6fdae328db4c8b892dfa
-
C:\Users\Admin\AppData\Roaming\Gongle\aASTN7O80X\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Roaming\Gongle\aJUSQKMZYT\LOGFilesize
331B
MD5ec05cc880a862c551c85c4d8e55c632a
SHA194c40df305f1703551410e0d0873f64127631876
SHA256748c214d6186a62e10968fd45868441fea50583515d2e64cb0777dedf659df39
SHA5127cf0922a9101f02d664f2697bbb64eaffe9ef542ef9ffc57d2a9613e93de2434b56505897d193301d61fa562f7f8fc23d06756beee7a3c26b505f5243af067a8
-
C:\Users\Admin\AppData\Roaming\Gongle\aJUSQKMZYT\LOG.oldFilesize
293B
MD5286d5bb3f69be4eab4811e00d9990bc0
SHA14dfc02636dffd6b2ff55d13b49194ef2634ddda5
SHA2565c66153797c75d4aff95d8d8a877a5c2b86b8ddab23a7304a5f581caca67f546
SHA51286d6518821eaff6394307edce00f0100daade467d9410d4f48547a1c81ad2ad1298c01bddda38beb7737d999c79a13a7111a4eb02cbf6c2c75071b90e627bbef
-
C:\Users\Admin\AppData\Roaming\Gongle\aM46IO30M5\ydz6lw8g.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteFilesize
48KB
MD51682bdb06875f76f973f6befb385109e
SHA1dcae1d6245729265460e438f8eef00ec3a43d93d
SHA2560ccb675d0b121aa49ffbf4706e7ac13e6c40ceb87057f0ca601ab397f95b7d33
SHA512e6bf2fe9c812387683a59a4cfa46119aa9ee8097138958a42077b2d9f46b8ac3240145d92a37eb1482836e06c73b068878d1a062bfde2c60a663de989d3e232d
-
memory/2984-42-0x0000000009210000-0x000000000921A000-memory.dmpFilesize
40KB
-
memory/2984-6-0x0000000074AC0000-0x0000000075271000-memory.dmpFilesize
7.7MB
-
memory/2984-1-0x0000000000C20000-0x0000000000C2C000-memory.dmpFilesize
48KB
-
memory/2984-201-0x000000000C1A0000-0x000000000C1AA000-memory.dmpFilesize
40KB
-
memory/2984-2-0x0000000004A10000-0x0000000004A2A000-memory.dmpFilesize
104KB
-
memory/2984-4-0x0000000004AF0000-0x0000000004B82000-memory.dmpFilesize
584KB
-
memory/2984-39-0x0000000007BC0000-0x0000000007BD2000-memory.dmpFilesize
72KB
-
memory/2984-40-0x0000000007EE0000-0x0000000007F46000-memory.dmpFilesize
408KB
-
memory/2984-41-0x0000000008010000-0x000000000801A000-memory.dmpFilesize
40KB
-
memory/2984-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmpFilesize
4KB
-
memory/2984-43-0x0000000009230000-0x000000000923C000-memory.dmpFilesize
48KB
-
memory/2984-44-0x00000000092A0000-0x00000000092A8000-memory.dmpFilesize
32KB
-
memory/2984-18-0x0000000074AC0000-0x0000000075271000-memory.dmpFilesize
7.7MB
-
memory/2984-17-0x0000000074ACE000-0x0000000074ACF000-memory.dmpFilesize
4KB
-
memory/2984-11-0x0000000011650000-0x00000000122F2000-memory.dmpFilesize
12.6MB
-
memory/2984-10-0x000000000A8C0000-0x000000000B4C0000-memory.dmpFilesize
12.0MB
-
memory/2984-5-0x0000000005140000-0x00000000056E6000-memory.dmpFilesize
5.6MB
-
memory/2984-186-0x000000000C0D0000-0x000000000C0F1000-memory.dmpFilesize
132KB
-
memory/2984-3-0x0000000000C10000-0x0000000000C1A000-memory.dmpFilesize
40KB
-
memory/2984-174-0x0000000009500000-0x00000000095B2000-memory.dmpFilesize
712KB
-
memory/2984-175-0x00000000095B0000-0x00000000095D2000-memory.dmpFilesize
136KB
-
memory/2984-176-0x000000000A490000-0x000000000A506000-memory.dmpFilesize
472KB
-
memory/2984-177-0x0000000009600000-0x000000000961E000-memory.dmpFilesize
120KB
-
memory/2984-178-0x000000000A510000-0x000000000A560000-memory.dmpFilesize
320KB
-
memory/2984-179-0x000000000A410000-0x000000000A47A000-memory.dmpFilesize
424KB
-
memory/2984-180-0x000000000A560000-0x000000000A8B7000-memory.dmpFilesize
3.3MB
-
memory/2984-181-0x000000000D0D0000-0x000000000D11C000-memory.dmpFilesize
304KB
-
memory/2984-185-0x000000000C110000-0x000000000C14C000-memory.dmpFilesize
240KB
-
memory/3244-28-0x0000000002CE0000-0x0000000002CE8000-memory.dmpFilesize
32KB
-
memory/3244-33-0x0000000002CE0000-0x0000000002CE8000-memory.dmpFilesize
32KB
-
memory/3244-29-0x0000000002D00000-0x0000000002D01000-memory.dmpFilesize
4KB
-
memory/3244-30-0x0000000002CE0000-0x0000000002CE8000-memory.dmpFilesize
32KB
-
memory/3244-32-0x0000000002CE0000-0x0000000002CE8000-memory.dmpFilesize
32KB