Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30-05-2024 21:50

General

  • Target

    easfawefawfas.exe

  • Size

    12KB

  • MD5

    2813b6e3ed4bd6b14c53e3dffcdff21d

  • SHA1

    5ac7c7a3dadde70f94810c608a2eb275f14b7bde

  • SHA256

    866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a

  • SHA512

    ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24

  • SSDEEP

    192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3324
      • C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe
        "C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3504
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs" /f
          3⤵
          • Modifies registry class
          PID:3560
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
          3⤵
          • Modifies registry class
          PID:4312
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C computerdefaults.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3468
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            computerdefaults.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4632
            • C:\Windows\SysWOW64\wscript.exe
              "wscript.exe" C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3052
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
                6⤵
                  PID:2316
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:404
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT
              4⤵
              • Creates scheduled task(s)
              PID:4060
          • C:\Users\Admin\AppData\Local\Temp\innkj420.exe
            "C:\Users\Admin\AppData\Local\Temp\innkj420.exe" explorer.exe
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5052

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\4cf661042dc34aab81e3813b18efd4f7

        Filesize

        8KB

        MD5

        1cefcb019f4eb58bf848a7da546a1410

        SHA1

        55c8dccbeb03714e924751d10e6b426b6d31a1eb

        SHA256

        41602fd14a9940efaacdef3d1d0c2b13bee1f9b89fe989720b4ac5f420b82ff2

        SHA512

        571c1cb1f7c4f3e258f25de602c1be510d62558a3a5a96c19b97cf7a25f8525322481e49c3bf21be18b8922fe5b7407f6d6da4fe1436fa93ac3e21233f5e1bc7

      • C:\Users\Admin\AppData\Local\Temp\7539523bb20e456caecae7ed81f6ed37

        Filesize

        46KB

        MD5

        8f5942354d3809f865f9767eddf51314

        SHA1

        20be11c0d42fc0cef53931ea9152b55082d1a11e

        SHA256

        776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

        SHA512

        fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

      • C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll

        Filesize

        1.4MB

        MD5

        6f2fdecc48e7d72ca1eb7f17a97e59ad

        SHA1

        fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

        SHA256

        70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

        SHA512

        fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

      • C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs

        Filesize

        171B

        MD5

        a34267102c21aff46aecc85598924544

        SHA1

        77268af47c6a4b9c6be7f7487b2c9b233d49d435

        SHA256

        eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44

        SHA512

        5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

      • C:\Users\Admin\AppData\Local\Temp\d8bc2fa194d540ab957dead28df05fc0

        Filesize

        130KB

        MD5

        724f526f3db486000a87c1b432f49bd1

        SHA1

        54bebd0469e487f55860faf86d2069ac66de4ce8

        SHA256

        2b265bbc14619dd0cf6c6dccd275def4df1e635b22cb0555455b0a13e7c3fa5d

        SHA512

        4e9079d654d89addae77928bffb8441ba84632b085d6f0af6c29e4fc2de28c1899cc50a0668d22a3d9845e0057b83cdab78f66dc839bb6ad27065a5bf9bbe0ff

      • C:\Users\Admin\AppData\Local\Temp\innkj420.exe

        Filesize

        124KB

        MD5

        e898826598a138f86f2aa80c0830707a

        SHA1

        1e912a5671f7786cc077f83146a0484e5a78729c

        SHA256

        df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a

        SHA512

        6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb

      • C:\Users\Admin\AppData\Roaming\Gongle\aJM0E4T51J\LOG

        Filesize

        331B

        MD5

        c62fa0ae094be3a08adf631da4948dde

        SHA1

        d38dc47c6157f3c396421d7da65e87cc8b831da0

        SHA256

        e9433b749fede4b5e597bdf6c73e9051c76f60544ab0e4183f24e93c8d880980

        SHA512

        625909fbd9805f0861830691a82c81ed3db21e4d2f64ca5f8fb836c66054cc7a2068828430aac8cfa37c5a6fe24e6ad9912a52c681706b8dfec26fb874058fdf

      • C:\Users\Admin\AppData\Roaming\Gongle\aJM0E4T51J\LOG.old

        Filesize

        293B

        MD5

        5a39c029e16d496bf123d83d2e5225fb

        SHA1

        51a91741fed8527f1817f0785fe5f551cb1b427f

        SHA256

        4fd0f638ce5670f768eb9a0b55beeb2dd79da741d9280c54bf574fd66a08f6af

        SHA512

        25eb87f7f84d1704554bd432be53ce1f3080ed9eed8aee900963250982f55161ed37ae9440971274f7a4f6eaf68fb71467dcf9c0a658417ad2bbf11aba3e00d1

      • C:\Users\Admin\AppData\Roaming\Gongle\aSYNTBFQMR\prbn7a8y.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

        Filesize

        48KB

        MD5

        66b205f04679b5f82c9ee9472f099446

        SHA1

        91108f3dd5250bcadfe377462f28eaaf93b10c27

        SHA256

        57ba14a574b090a73ae86ced20545d87a04c7da16cb9a1eb5c171ffe11233468

        SHA512

        aabe92889ceead8c6422833ed42b430d452aa5a5d12975048538b34bcf4c6bdaeb02d7491b5a31cd3102598ae2683556e60e25f33ccdbc1cf4453e65dc5e1ec4

      • C:\Users\Admin\AppData\Roaming\Gongle\aZE9NU79P5\CURRENT

        Filesize

        16B

        MD5

        46295cac801e5d4857d09837238a6394

        SHA1

        44e0fa1b517dbf802b18faf0785eeea6ac51594b

        SHA256

        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

        SHA512

        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

      • C:\Users\Admin\AppData\Roaming\Gongle\aZE9NU79P5\LOG

        Filesize

        329B

        MD5

        ea925480aeb69e86c75f5b49f90cb32f

        SHA1

        32a1c68fe8a3a4781fa2d9341790776305d34749

        SHA256

        fa1e9256b6eae98eacf7b053a503afed4df979df08897cffdce7dd8b47e2e366

        SHA512

        6510c9be306bc7b2e2d03a28816f7e7f59b663868fd959327fc82c75cfe0b4f04ce73cad45ed55d36e87a5054a6ebd74b9857a3ba0d7b1b23107e847325e2e64

      • C:\Users\Admin\AppData\Roaming\Gongle\aZE9NU79P5\LOG.old

        Filesize

        289B

        MD5

        069e4a217190d6cb62860b48f40df265

        SHA1

        29951438604029ddcbf69f5e5336ec3389e30396

        SHA256

        ee6d40510ba91172380f180e8a9bd6203b4f69fa6e7cf9d7cf29c0f106536d98

        SHA512

        86a29efcf4813649b657af86227906d78ccfab879d98f8ece54407dc576108d81f7dfdf214c67a3764ec4cee78ac9cdec6bf9922b61e6b0b401ca098a76cc8ef

      • C:\Users\Admin\AppData\Roaming\Gongle\aZE9NU79P5\MANIFEST-000001

        Filesize

        41B

        MD5

        5af87dfd673ba2115e2fcf5cfdb727ab

        SHA1

        d5b5bbf396dc291274584ef71f444f420b6056f1

        SHA256

        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

        SHA512

        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

      • memory/3324-33-0x0000000000B70000-0x0000000000B78000-memory.dmp

        Filesize

        32KB

      • memory/3324-29-0x0000000000B90000-0x0000000000B91000-memory.dmp

        Filesize

        4KB

      • memory/3324-28-0x0000000000B70000-0x0000000000B78000-memory.dmp

        Filesize

        32KB

      • memory/3324-32-0x0000000000B70000-0x0000000000B78000-memory.dmp

        Filesize

        32KB

      • memory/3324-30-0x0000000000B70000-0x0000000000B78000-memory.dmp

        Filesize

        32KB

      • memory/3504-42-0x0000000008340000-0x000000000834C000-memory.dmp

        Filesize

        48KB

      • memory/3504-173-0x0000000009AD0000-0x0000000009B82000-memory.dmp

        Filesize

        712KB

      • memory/3504-41-0x0000000008370000-0x000000000837A000-memory.dmp

        Filesize

        40KB

      • memory/3504-40-0x0000000008380000-0x00000000083E6000-memory.dmp

        Filesize

        408KB

      • memory/3504-0-0x000000007498E000-0x000000007498F000-memory.dmp

        Filesize

        4KB

      • memory/3504-43-0x00000000083F0000-0x00000000083F8000-memory.dmp

        Filesize

        32KB

      • memory/3504-13-0x0000000013360000-0x0000000014002000-memory.dmp

        Filesize

        12.6MB

      • memory/3504-12-0x000000000B5D0000-0x000000000C1D0000-memory.dmp

        Filesize

        12.0MB

      • memory/3504-11-0x0000000074980000-0x0000000075131000-memory.dmp

        Filesize

        7.7MB

      • memory/3504-10-0x000000007498E000-0x000000007498F000-memory.dmp

        Filesize

        4KB

      • memory/3504-6-0x0000000074980000-0x0000000075131000-memory.dmp

        Filesize

        7.7MB

      • memory/3504-5-0x0000000005EF0000-0x0000000006496000-memory.dmp

        Filesize

        5.6MB

      • memory/3504-4-0x00000000057F0000-0x0000000005882000-memory.dmp

        Filesize

        584KB

      • memory/3504-39-0x0000000006D80000-0x0000000006D8A000-memory.dmp

        Filesize

        40KB

      • memory/3504-174-0x0000000008820000-0x0000000008842000-memory.dmp

        Filesize

        136KB

      • memory/3504-175-0x0000000009C00000-0x0000000009C76000-memory.dmp

        Filesize

        472KB

      • memory/3504-176-0x0000000009030000-0x000000000904E000-memory.dmp

        Filesize

        120KB

      • memory/3504-177-0x0000000009C80000-0x0000000009CD0000-memory.dmp

        Filesize

        320KB

      • memory/3504-179-0x0000000009D40000-0x000000000A097000-memory.dmp

        Filesize

        3.3MB

      • memory/3504-180-0x000000000A0A0000-0x000000000A0EC000-memory.dmp

        Filesize

        304KB

      • memory/3504-178-0x0000000009CD0000-0x0000000009D3A000-memory.dmp

        Filesize

        424KB

      • memory/3504-185-0x000000000A140000-0x000000000A161000-memory.dmp

        Filesize

        132KB

      • memory/3504-184-0x000000000A180000-0x000000000A1BC000-memory.dmp

        Filesize

        240KB

      • memory/3504-3-0x0000000003170000-0x000000000317A000-memory.dmp

        Filesize

        40KB

      • memory/3504-2-0x0000000003180000-0x000000000319A000-memory.dmp

        Filesize

        104KB

      • memory/3504-1-0x0000000000880000-0x000000000088C000-memory.dmp

        Filesize

        48KB

      • memory/3504-200-0x0000000007050000-0x000000000705A000-memory.dmp

        Filesize

        40KB