Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
30/05/2024, 21:21
General
- Target easfawefawfas.exe
- Size 12KB
- Sample240530-z7cjcaaa5x
- SHA256 866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
Malware Config
Extracted
-
gozi
Signatures
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs" /f3⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts6⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT4⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\mfuwmk43.exe"C:\Users\Admin\AppData\Local\Temp\mfuwmk43.exe" explorer.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3bf1c26b14e649dab57c3562afdd5cc9
sqlite.interop.dll
bfec8022392846378dafaf1dcd55792e
consoleitaly1826.vbs
dcf4d704dae14da2998fe4c6f4947ad1
mfuwmk43.exe
LOG
LOG.old
CURRENT
LOG
LOG.old
MANIFEST-000001
3561288849sdhlie.sqlite
memory/3444-30-0x0000000002BF0000-0x0000000002BF8000-memory.dmp
memory/3444-28-0x0000000002BF0000-0x0000000002BF8000-memory.dmp
memory/3444-27-0x0000000002DB0000-0x0000000002DB1000-memory.dmp
memory/3444-26-0x0000000002BF0000-0x0000000002BF8000-memory.dmp
memory/3444-31-0x0000000002BF0000-0x0000000002BF8000-memory.dmp
memory/3624-42-0x00000000094E0000-0x00000000094EA000-memory.dmp
memory/3624-4-0x0000000004E10000-0x0000000004EA2000-memory.dmp
memory/3624-40-0x00000000081E0000-0x0000000008246000-memory.dmp
memory/3624-41-0x0000000008310000-0x000000000831A000-memory.dmp
memory/3624-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp
memory/3624-44-0x00000000097B0000-0x00000000097B8000-memory.dmp
memory/3624-43-0x00000000094C0000-0x00000000094CC000-memory.dmp
memory/3624-38-0x0000000074D0E000-0x0000000074D0F000-memory.dmp
memory/3624-37-0x0000000007730000-0x0000000007742000-memory.dmp
memory/3624-11-0x0000000011870000-0x0000000012512000-memory.dmp
memory/3624-10-0x000000000AAE0000-0x000000000B6E0000-memory.dmp
memory/3624-6-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/3624-5-0x00000000054F0000-0x0000000005A94000-memory.dmp
memory/3624-39-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/3624-173-0x0000000006560000-0x0000000006612000-memory.dmp
memory/3624-174-0x0000000006670000-0x0000000006692000-memory.dmp
memory/3624-175-0x0000000006720000-0x0000000006796000-memory.dmp
memory/3624-176-0x00000000066D0000-0x00000000066EE000-memory.dmp
memory/3624-178-0x0000000006810000-0x0000000006860000-memory.dmp
memory/3624-179-0x0000000006860000-0x00000000068CA000-memory.dmp
memory/3624-180-0x00000000068D0000-0x0000000006C24000-memory.dmp
memory/3624-181-0x0000000006C30000-0x0000000006C7C000-memory.dmp
memory/3624-185-0x0000000006CE0000-0x0000000006D1C000-memory.dmp
memory/3624-186-0x0000000006CA0000-0x0000000006CC1000-memory.dmp
memory/3624-3-0x00000000027D0000-0x00000000027DA000-memory.dmp
memory/3624-2-0x0000000002810000-0x000000000282A000-memory.dmp
memory/3624-201-0x0000000006D70000-0x0000000006D7A000-memory.dmp
memory/3624-1-0x0000000000470000-0x000000000047C000-memory.dmp