Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30-05-2024 21:51

General

  • Target

    easfawefawfas.exe

  • Size

    12KB

  • MD5

    2813b6e3ed4bd6b14c53e3dffcdff21d

  • SHA1

    5ac7c7a3dadde70f94810c608a2eb275f14b7bde

  • SHA256

    866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a

  • SHA512

    ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24

  • SSDEEP

    192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3384
    • C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe
      "C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs" /f
        3⤵
        • Modifies registry class
        PID:932
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
        3⤵
        • Modifies registry class
        PID:396
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C computerdefaults.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5012
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          computerdefaults.exe
          4⤵
            PID:1884
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3832
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT
            4⤵
            • Creates scheduled task(s)
            PID:356
        • C:\Users\Admin\AppData\Local\Temp\aqrfd0en.exe
          "C:\Users\Admin\AppData\Local\Temp\aqrfd0en.exe" explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3372

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\067ddaded7d145de9c34934f6bea77cf

      Filesize

      136KB

      MD5

      191c945d90620ea75c6db98c33905cd6

      SHA1

      ff0677415a57edc3e2dc0331d62b63d453eb5358

      SHA256

      6c89e656d34bd90176321ee29c8f820979d2cc3cfd73e2fdf0cb4e6baf80666f

      SHA512

      6d6d3c8e992132d1603425a8ced2a8ee965ed35673ba881229b341c8c30c7866b8c1fe7543212b67d928326dc605ecc36eb7c2a0e98876029478201253089259

    • C:\Users\Admin\AppData\Local\Temp\aqrfd0en.exe

      Filesize

      124KB

      MD5

      e898826598a138f86f2aa80c0830707a

      SHA1

      1e912a5671f7786cc077f83146a0484e5a78729c

      SHA256

      df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a

      SHA512

      6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb

    • C:\Users\Admin\AppData\Roaming\Gongle\a6LT5TCC33\CURRENT

      Filesize

      16B

      MD5

      46295cac801e5d4857d09837238a6394

      SHA1

      44e0fa1b517dbf802b18faf0785eeea6ac51594b

      SHA256

      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

      SHA512

      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

    • C:\Users\Admin\AppData\Roaming\Gongle\a6LT5TCC33\LOG

      Filesize

      329B

      MD5

      0023f9957b9c209893ccb5949cbdb31b

      SHA1

      813146ac4131b06e332b62a3ea07af8942ddb75f

      SHA256

      b021be34d5333703a46bb6a15a77dc2dffcc7fdd94fa0877b1c0b102e1c5ea6b

      SHA512

      53bd584c17c17b42b03725b4d8f435957f8afa251309dcfe9960b8393ccfc53917c0f3c99bb4abf58d80d7cbee2a44dc934436415d1cc8e0f0f3687875e2826c

    • C:\Users\Admin\AppData\Roaming\Gongle\a6LT5TCC33\LOG.old

      Filesize

      291B

      MD5

      b2df2290f73e0eac3e80d78eb1ef3602

      SHA1

      9c079ec457fa774394508671948bf4147b9644b6

      SHA256

      838554e15d2145dd1fc86d1fd4e91a263e859a02a199688f8509f6d73b38f652

      SHA512

      791706e08f6171fa7a13a8bb70ae835dd1041e8f4cc72fe7ee2d081771222ef950dab0e17887ea88ba97ac73fca0b02f74cadda27e210b9c2b1877d8b542961d

    • C:\Users\Admin\AppData\Roaming\Gongle\a6LT5TCC33\MANIFEST-000001

      Filesize

      41B

      MD5

      5af87dfd673ba2115e2fcf5cfdb727ab

      SHA1

      d5b5bbf396dc291274584ef71f444f420b6056f1

      SHA256

      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

      SHA512

      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

    • C:\Users\Admin\AppData\Roaming\Gongle\aN2GQDR0AF\wjyk7j4u.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

      Filesize

      48KB

      MD5

      854a10c0922c27cfeffb77307ee80a71

      SHA1

      bb8cbe8467bfc490031e29fb27fe50ec014f53e2

      SHA256

      f696b1fa16384ecdec974e1bc9a8841fd50cb739818654dc3c7716821d52f69b

      SHA512

      a5004751e3b89fdf4ce49492c46d09eca1a0177c57cacc6546deb236a17c747600748537687713516565330907a2541d3bba4b96cc3b106d589e38ef09b86162

    • \Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll

      Filesize

      1.4MB

      MD5

      6f2fdecc48e7d72ca1eb7f17a97e59ad

      SHA1

      fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

      SHA256

      70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

      SHA512

      fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

    • memory/3384-21-0x0000000000DB0000-0x0000000000DB8000-memory.dmp

      Filesize

      32KB

    • memory/3384-28-0x0000000000DB0000-0x0000000000DB8000-memory.dmp

      Filesize

      32KB

    • memory/3384-27-0x0000000000DB0000-0x0000000000DB8000-memory.dmp

      Filesize

      32KB

    • memory/3384-25-0x0000000000DB0000-0x0000000000DB8000-memory.dmp

      Filesize

      32KB

    • memory/3384-22-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

      Filesize

      4KB

    • memory/4760-37-0x0000000008800000-0x000000000880C000-memory.dmp

      Filesize

      48KB

    • memory/4760-2-0x00000000025D0000-0x00000000025EA000-memory.dmp

      Filesize

      104KB

    • memory/4760-34-0x0000000000A80000-0x0000000000A8A000-memory.dmp

      Filesize

      40KB

    • memory/4760-36-0x000000000A080000-0x000000000A0E6000-memory.dmp

      Filesize

      408KB

    • memory/4760-35-0x000000000A000000-0x000000000A00A000-memory.dmp

      Filesize

      40KB

    • memory/4760-0-0x00007FFCC9220000-0x00007FFCC93FB000-memory.dmp

      Filesize

      1.9MB

    • memory/4760-38-0x0000000008820000-0x0000000008828000-memory.dmp

      Filesize

      32KB

    • memory/4760-8-0x000000000A520000-0x000000000B120000-memory.dmp

      Filesize

      12.0MB

    • memory/4760-5-0x0000000005000000-0x00000000054FE000-memory.dmp

      Filesize

      5.0MB

    • memory/4760-4-0x0000000004A60000-0x0000000004AF2000-memory.dmp

      Filesize

      584KB

    • memory/4760-3-0x00000000025C0000-0x00000000025CA000-memory.dmp

      Filesize

      40KB

    • memory/4760-9-0x0000000012270000-0x0000000012F12000-memory.dmp

      Filesize

      12.6MB

    • memory/4760-146-0x0000000008830000-0x00000000088E2000-memory.dmp

      Filesize

      712KB

    • memory/4760-147-0x0000000008950000-0x0000000008972000-memory.dmp

      Filesize

      136KB

    • memory/4760-148-0x0000000008A00000-0x0000000008A76000-memory.dmp

      Filesize

      472KB

    • memory/4760-149-0x00000000089C0000-0x00000000089DE000-memory.dmp

      Filesize

      120KB

    • memory/4760-150-0x0000000008AD0000-0x0000000008B20000-memory.dmp

      Filesize

      320KB

    • memory/4760-151-0x0000000008B20000-0x0000000008B8A000-memory.dmp

      Filesize

      424KB

    • memory/4760-152-0x0000000008B90000-0x0000000008EE0000-memory.dmp

      Filesize

      3.3MB

    • memory/4760-153-0x0000000008EE0000-0x0000000008F2B000-memory.dmp

      Filesize

      300KB

    • memory/4760-157-0x00000000091B0000-0x00000000091EC000-memory.dmp

      Filesize

      240KB

    • memory/4760-158-0x0000000009180000-0x00000000091A0000-memory.dmp

      Filesize

      128KB

    • memory/4760-1-0x00000000003C0000-0x00000000003CC000-memory.dmp

      Filesize

      48KB

    • memory/4760-164-0x0000000009210000-0x000000000921A000-memory.dmp

      Filesize

      40KB