Analysis
-
max time kernel
49s -
max time network
50s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
02-06-2024 23:28
Static task
static1
Behavioral task
behavioral1
Sample
tster.exe
Resource
win10v2004-20240508-en
General
-
Target
tster.exe
-
Size
11KB
-
MD5
feb6fd23d005b8d70446866b206042f8
-
SHA1
d7d01f6639e0f060e91a35949f9bf346aa0ea81a
-
SHA256
81f3c9ef76877647a56874054c58756d67e512ad55a0ab273dfa5e88dddd7c5c
-
SHA512
20f86fa77e079bd3794c32e793a9adb79ad7d847ca8d74591321153330dfa9aa15d11279b45a9497fec910b58533cdeedc293858fa29d20ffb80f96d519c70da
-
SSDEEP
192:52R8JP/PCS+plrpcV5K9+JPiukknPfhTx0ujmN+LKyOLi:58Q/a9plrpcVI9SKQfgutKyOL
Malware Config
Extracted
gozi
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
dqbzkho5.exepid process 2480 dqbzkho5.exe -
Loads dropped DLL 1 IoCs
Processes:
tster.exepid process 1116 tster.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 6 discord.com 9 discord.com 1 raw.githubusercontent.com 1 discord.com 2 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 checkip.amazonaws.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 7 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\ms-settings\shell\open\command reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0" reg.exe Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\ms-settings\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\pearpear81962580.vbs" reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tster.exedqbzkho5.exepid process 1116 tster.exe 1116 tster.exe 1116 tster.exe 2480 dqbzkho5.exe 2480 dqbzkho5.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe 1116 tster.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tster.exedqbzkho5.exedescription pid process Token: SeDebugPrivilege 1116 tster.exe Token: SeDebugPrivilege 2480 dqbzkho5.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
tster.exepid process 1116 tster.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
tster.execmd.exeComputerDefaults.exewscript.execmd.exedqbzkho5.exedescription pid process target process PID 1116 wrote to memory of 1028 1116 tster.exe reg.exe PID 1116 wrote to memory of 1028 1116 tster.exe reg.exe PID 1116 wrote to memory of 1028 1116 tster.exe reg.exe PID 1116 wrote to memory of 2412 1116 tster.exe reg.exe PID 1116 wrote to memory of 2412 1116 tster.exe reg.exe PID 1116 wrote to memory of 2412 1116 tster.exe reg.exe PID 1116 wrote to memory of 2268 1116 tster.exe cmd.exe PID 1116 wrote to memory of 2268 1116 tster.exe cmd.exe PID 1116 wrote to memory of 2268 1116 tster.exe cmd.exe PID 2268 wrote to memory of 4712 2268 cmd.exe ComputerDefaults.exe PID 2268 wrote to memory of 4712 2268 cmd.exe ComputerDefaults.exe PID 2268 wrote to memory of 4712 2268 cmd.exe ComputerDefaults.exe PID 4712 wrote to memory of 2520 4712 ComputerDefaults.exe wscript.exe PID 4712 wrote to memory of 2520 4712 ComputerDefaults.exe wscript.exe PID 4712 wrote to memory of 2520 4712 ComputerDefaults.exe wscript.exe PID 2520 wrote to memory of 5112 2520 wscript.exe cmd.exe PID 2520 wrote to memory of 5112 2520 wscript.exe cmd.exe PID 2520 wrote to memory of 5112 2520 wscript.exe cmd.exe PID 1116 wrote to memory of 2168 1116 tster.exe cmd.exe PID 1116 wrote to memory of 2168 1116 tster.exe cmd.exe PID 1116 wrote to memory of 2168 1116 tster.exe cmd.exe PID 2168 wrote to memory of 3508 2168 cmd.exe schtasks.exe PID 2168 wrote to memory of 3508 2168 cmd.exe schtasks.exe PID 2168 wrote to memory of 3508 2168 cmd.exe schtasks.exe PID 1116 wrote to memory of 2480 1116 tster.exe dqbzkho5.exe PID 1116 wrote to memory of 2480 1116 tster.exe dqbzkho5.exe PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE PID 2480 wrote to memory of 3332 2480 dqbzkho5.exe Explorer.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\tster.exe"C:\Users\Admin\AppData\Local\Temp\tster.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\pearpear81962580.vbs" /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\pearpear81962580.vbs5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN PlexMediaServerUpdater_9DaxSEEMIrKyr0dPz050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Credentials\9DaxSEEMIrKyr0dPz050MX.exe" /RL HIGHEST /IT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN PlexMediaServerUpdater_9DaxSEEMIrKyr0dPz050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Credentials\9DaxSEEMIrKyr0dPz050MX.exe" /RL HIGHEST /IT4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\dqbzkho5.exe"C:\Users\Admin\AppData\Local\Temp\dqbzkho5.exe" explorer.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dllFilesize
1.4MB
MD56f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA25670e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b
-
C:\Users\Admin\AppData\Local\Temp\dqbzkho5.exeFilesize
124KB
MD5e898826598a138f86f2aa80c0830707a
SHA11e912a5671f7786cc077f83146a0484e5a78729c
SHA256df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA5126827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
-
C:\Users\Admin\AppData\Local\Temp\pearpear81962580.vbsFilesize
171B
MD5a34267102c21aff46aecc85598924544
SHA177268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA5125d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3
-
C:\Users\Admin\AppData\Roaming\Gongle\aIXAYRKHQX\dpu1uz4v.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteFilesize
48KB
MD5153d58ff42ed567a976c3f943c85740e
SHA12ebbc8e725d577de17dd4f73dc80e17c2a03bbd8
SHA256e3e69c2ec78ab1badf3ec3ab07881b0db10dacebbac039c1032a76a67fb806cf
SHA512068f79604ae83bf657603c57ac786f2ccc1a465776101ab15dbcc28ec0888cdc1c61d4d40a0b0ae22c32c60becd354588ef960220946c2f7f9f119d55cfc6037
-
memory/1116-6-0x00000000055C0000-0x0000000005B66000-memory.dmpFilesize
5.6MB
-
memory/1116-40-0x0000000007E30000-0x0000000007E96000-memory.dmpFilesize
408KB
-
memory/1116-0-0x000000007488E000-0x000000007488F000-memory.dmpFilesize
4KB
-
memory/1116-4-0x0000000004F70000-0x0000000005002000-memory.dmpFilesize
584KB
-
memory/1116-10-0x000000000AD60000-0x000000000B960000-memory.dmpFilesize
12.0MB
-
memory/1116-11-0x000000007488E000-0x000000007488F000-memory.dmpFilesize
4KB
-
memory/1116-12-0x0000000011AF0000-0x0000000012792000-memory.dmpFilesize
12.6MB
-
memory/1116-3-0x0000000002A00000-0x0000000002A0A000-memory.dmpFilesize
40KB
-
memory/1116-2-0x0000000002A10000-0x0000000002A2A000-memory.dmpFilesize
104KB
-
memory/1116-1-0x0000000000A00000-0x0000000000A0A000-memory.dmpFilesize
40KB
-
memory/1116-44-0x0000000008D80000-0x0000000008D88000-memory.dmpFilesize
32KB
-
memory/1116-43-0x0000000008C80000-0x0000000008C8C000-memory.dmpFilesize
48KB
-
memory/1116-42-0x0000000008C60000-0x0000000008C6A000-memory.dmpFilesize
40KB
-
memory/1116-41-0x0000000007EF0000-0x0000000007EFA000-memory.dmpFilesize
40KB
-
memory/1116-38-0x0000000009160000-0x0000000009172000-memory.dmpFilesize
72KB
-
memory/1116-39-0x0000000074880000-0x0000000075031000-memory.dmpFilesize
7.7MB
-
memory/1116-5-0x0000000074880000-0x0000000075031000-memory.dmpFilesize
7.7MB
-
memory/3332-32-0x0000000002EB0000-0x0000000002EB8000-memory.dmpFilesize
32KB
-
memory/3332-27-0x0000000002EB0000-0x0000000002EB8000-memory.dmpFilesize
32KB
-
memory/3332-28-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/3332-31-0x0000000002EB0000-0x0000000002EB8000-memory.dmpFilesize
32KB
-
memory/3332-29-0x0000000002EB0000-0x0000000002EB8000-memory.dmpFilesize
32KB