Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 08:02
Static task
static1
Behavioral task
behavioral1
Sample
36599208287637_182387937827.vbs
Resource
win7-20240903-en
General
-
Target
36599208287637_182387937827.vbs
-
Size
2.0MB
-
MD5
38b6d2b8eb400e54a5382b3b4b028639
-
SHA1
feedae24f937be7be234d213461e50f91e985e68
-
SHA256
54663fd1d1312b20fb9ac3015ccf77ef094069c5719f5e0cdd71e8243a97a4c7
-
SHA512
413b3bbd3367b2d414aeba286303baaf96a3ee932a0f11b9b2e1b387ce62a41c1d1a4718f235a9b7894bdf408dbb95a284ce77b464614bb8c3f4fe29367b27eb
-
SSDEEP
49152:DfEgMVfAz54XC5ocIaev2kkjxeGsiqxfnrq4lxIeGa0KVt+1nZiLLHhyoU8:+
Malware Config
Extracted
gozi
Extracted
gozi
63
http://aaxvkah7dudzoloq.onion
http://cloud-start.at
http://mashallah.at
-
build
217083
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Signatures
-
Gozi family
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3012 2756 regsvr32.exe 30 -
Loads dropped DLL 1 IoCs
pid Process 2716 regsvr32.exe -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\davhput8 = "rundll32 \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Dmdlsitf\\bitsPQEC.dll\",DllRegisterServer" Explorer.EXE -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2716 set thread context of 2444 2716 regsvr32.exe 34 PID 2444 set thread context of 1204 2444 control.exe 21 PID 2444 set thread context of 2804 2444 control.exe 35 PID 1204 set thread context of 2468 1204 Explorer.EXE 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2716 regsvr32.exe 1204 Explorer.EXE -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 2716 regsvr32.exe 2444 control.exe 2444 control.exe 1204 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1732 WScript.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2716 3012 regsvr32.exe 32 PID 3012 wrote to memory of 2716 3012 regsvr32.exe 32 PID 3012 wrote to memory of 2716 3012 regsvr32.exe 32 PID 3012 wrote to memory of 2716 3012 regsvr32.exe 32 PID 3012 wrote to memory of 2716 3012 regsvr32.exe 32 PID 3012 wrote to memory of 2716 3012 regsvr32.exe 32 PID 3012 wrote to memory of 2716 3012 regsvr32.exe 32 PID 2716 wrote to memory of 2444 2716 regsvr32.exe 34 PID 2716 wrote to memory of 2444 2716 regsvr32.exe 34 PID 2716 wrote to memory of 2444 2716 regsvr32.exe 34 PID 2716 wrote to memory of 2444 2716 regsvr32.exe 34 PID 2716 wrote to memory of 2444 2716 regsvr32.exe 34 PID 2716 wrote to memory of 2444 2716 regsvr32.exe 34 PID 2716 wrote to memory of 2444 2716 regsvr32.exe 34 PID 2444 wrote to memory of 1204 2444 control.exe 21 PID 2444 wrote to memory of 1204 2444 control.exe 21 PID 2444 wrote to memory of 1204 2444 control.exe 21 PID 2444 wrote to memory of 2804 2444 control.exe 35 PID 2444 wrote to memory of 2804 2444 control.exe 35 PID 2444 wrote to memory of 2804 2444 control.exe 35 PID 2444 wrote to memory of 2804 2444 control.exe 35 PID 1204 wrote to memory of 1856 1204 Explorer.EXE 36 PID 1204 wrote to memory of 1856 1204 Explorer.EXE 36 PID 1204 wrote to memory of 1856 1204 Explorer.EXE 36 PID 1856 wrote to memory of 2968 1856 cmd.exe 38 PID 1856 wrote to memory of 2968 1856 cmd.exe 38 PID 1856 wrote to memory of 2968 1856 cmd.exe 38 PID 1204 wrote to memory of 348 1204 Explorer.EXE 39 PID 1204 wrote to memory of 348 1204 Explorer.EXE 39 PID 1204 wrote to memory of 348 1204 Explorer.EXE 39 PID 1204 wrote to memory of 2468 1204 Explorer.EXE 41 PID 1204 wrote to memory of 2468 1204 Explorer.EXE 41 PID 1204 wrote to memory of 2468 1204 Explorer.EXE 41 PID 1204 wrote to memory of 2468 1204 Explorer.EXE 41 PID 1204 wrote to memory of 2468 1204 Explorer.EXE 41 PID 1204 wrote to memory of 2468 1204 Explorer.EXE 41 PID 1204 wrote to memory of 2468 1204 Explorer.EXE 41 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36599208287637_182387937827.vbs"2⤵
- Suspicious use of FindShellTrayWindow
PID:1732
-
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\6618.bi1"2⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵PID:2968
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\6618.bi1"2⤵PID:348
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
- System Location Discovery: System Language Discovery
PID:2468
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\larbYbcl.txt1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\larbYbcl.txt2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\system32\control.exeC:\Windows\system32\control.exe /?3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?4⤵PID:2804
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122B
MD54e722b4828cea8a135eb7a2bfd92ab01
SHA18e1abee672a878fd9c1d33e242502205d9b2da55
SHA256c4d1feacbfb9ecd1a24e9b6d3e51fc7e9797da543d319f43ff0917db4c1e5e02
SHA51288c0d6b07d45f906164b2c1178a938ffb56c4fa7288853a02f460339bca026fa58b26a37f52ea846bc205e1828f12f0361d1b0425a1106c8b1a947856d4ee4e4
-
Filesize
702KB
MD52a7eb1adf21d776727a66bda5205c246
SHA1538bf0c672575d56c9b1ccc1f0bcffa0ae84ed5a
SHA2568ab9d7ae68a251448a32e68d0fc68204ab766f29d5f74ff43ec7e91ee9b4046b
SHA51279d69104ced64a60b711a4f84e7a0ca596cfc67652eed5351e4a68e0ad36b1336fbafa71cfdb8af4660dfb1f00881f5526b50d7dc3fa1db21240f43881e70fa8
-
Filesize
1.0MB
MD539587b18ca6dc5a9f91cb76ee3ee0b99
SHA12ca7ed111b008212d3ec8a63d8ef5a0c9d71d1b5
SHA25605b508103f8f3d634d04cdfb0eaa52ca2be07638a6d23a749888029dc6d1fee5
SHA512b856b6d3e93c11fd988e8d2663109f07cb66d58b1095861d6c8c496a2a4e7ae9ca5070bd40cc233b8e49cc1d30b666c9de3cf6b73311776c85ee36a6082184a3