Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
- submitted
30/05/2024, 21:21
General
- Target easfawefawfas.exe
- Size 12KB
- Sample240530-z7cjcaaa5x
- SHA256 866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
Malware Config
Extracted
-
gozi
Signatures
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs" /f3⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts6⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT4⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\aod31yef.exe"C:\Users\Admin\AppData\Local\Temp\aod31yef.exe" explorer.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
0ef0f1d7edcd4c37883846d667b57c02
1ce594fd2f184d6b9fe97da419531192
sqlite.interop.dll
aod31yef.exe
consoleitaly1826.vbs
fea49aaa36644c2fafc7c29654efe4af
CURRENT
LOG
LOG.old
MANIFEST-000001
3561288849sdhlie.sqlite
LOG
LOG.old
memory/2284-42-0x000000000B6B0000-0x000000000B6BA000-memory.dmp
memory/2284-5-0x0000000005FB0000-0x0000000006556000-memory.dmp
memory/2284-1-0x00000000001E0000-0x00000000001EC000-memory.dmp
memory/2284-201-0x0000000007E60000-0x0000000007E6A000-memory.dmp
memory/2284-2-0x00000000033F0000-0x000000000340A000-memory.dmp
memory/2284-3-0x00000000033E0000-0x00000000033EA000-memory.dmp
memory/2284-39-0x0000000001750000-0x0000000001762000-memory.dmp
memory/2284-40-0x00000000088D0000-0x0000000008936000-memory.dmp
memory/2284-41-0x00000000019C0000-0x00000000019CA000-memory.dmp
memory/2284-0-0x00000000744EE000-0x00000000744EF000-memory.dmp
memory/2284-43-0x000000000AD20000-0x000000000AD2C000-memory.dmp
memory/2284-44-0x000000000AD40000-0x000000000AD48000-memory.dmp
memory/2284-13-0x0000000013490000-0x0000000014132000-memory.dmp
memory/2284-12-0x000000000B700000-0x000000000C300000-memory.dmp
memory/2284-11-0x00000000744E0000-0x0000000074C91000-memory.dmp
memory/2284-10-0x00000000744EE000-0x00000000744EF000-memory.dmp
memory/2284-6-0x00000000744E0000-0x0000000074C91000-memory.dmp
memory/2284-185-0x0000000007DD0000-0x0000000007E0C000-memory.dmp
memory/2284-4-0x0000000005960000-0x00000000059F2000-memory.dmp
memory/2284-173-0x000000000AD50000-0x000000000AE02000-memory.dmp
memory/2284-174-0x000000000AE50000-0x000000000AE72000-memory.dmp
memory/2284-175-0x000000000AF00000-0x000000000AF76000-memory.dmp
memory/2284-176-0x000000000AEC0000-0x000000000AEDE000-memory.dmp
memory/2284-178-0x000000000AFD0000-0x000000000B020000-memory.dmp
memory/2284-179-0x000000000B020000-0x000000000B08A000-memory.dmp
memory/2284-180-0x000000000B090000-0x000000000B3E7000-memory.dmp
memory/2284-181-0x000000000B620000-0x000000000B66C000-memory.dmp
memory/2284-186-0x00000000071B0000-0x00000000071D1000-memory.dmp
memory/3324-28-0x0000000001350000-0x0000000001358000-memory.dmp
memory/3324-34-0x0000000001350000-0x0000000001358000-memory.dmp
memory/3324-29-0x0000000001370000-0x0000000001371000-memory.dmp
memory/3324-30-0x0000000001350000-0x0000000001358000-memory.dmp
memory/3324-32-0x0000000001350000-0x0000000001358000-memory.dmp