Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2024 08:02

General

  • Target

    36599208287637_182387937827.vbs

  • Size

    2.0MB

  • MD5

    38b6d2b8eb400e54a5382b3b4b028639

  • SHA1

    feedae24f937be7be234d213461e50f91e985e68

  • SHA256

    54663fd1d1312b20fb9ac3015ccf77ef094069c5719f5e0cdd71e8243a97a4c7

  • SHA512

    413b3bbd3367b2d414aeba286303baaf96a3ee932a0f11b9b2e1b387ce62a41c1d1a4718f235a9b7894bdf408dbb95a284ce77b464614bb8c3f4fe29367b27eb

  • SSDEEP

    49152:DfEgMVfAz54XC5ocIaev2kkjxeGsiqxfnrq4lxIeGa0KVt+1nZiLLHhyoU8:+

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

63

C2

http://aaxvkah7dudzoloq.onion

http://cloud-start.at

http://mashallah.at

Attributes
  • build

    217083

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Gozi family
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36599208287637_182387937827.vbs"
      2⤵
      • Suspicious use of FindShellTrayWindow
      PID:1732
    • C:\Windows\system32\cmd.exe
      cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\6618.bi1"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1856
      • C:\Windows\system32\nslookup.exe
        nslookup myip.opendns.com resolver1.opendns.com
        3⤵
          PID:2968
      • C:\Windows\system32\cmd.exe
        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\6618.bi1"
        2⤵
          PID:348
        • C:\Windows\syswow64\cmd.exe
          "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2468
      • C:\Windows\System32\regsvr32.exe
        C:\Windows\System32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\larbYbcl.txt
        1⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:3012
        • C:\Windows\SysWOW64\regsvr32.exe
          -s C:\Users\Admin\AppData\Local\Temp\larbYbcl.txt
          2⤵
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Windows\system32\control.exe
            C:\Windows\system32\control.exe /?
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2444
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?
              4⤵
                PID:2804

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\6618.bi1

          Filesize

          122B

          MD5

          4e722b4828cea8a135eb7a2bfd92ab01

          SHA1

          8e1abee672a878fd9c1d33e242502205d9b2da55

          SHA256

          c4d1feacbfb9ecd1a24e9b6d3e51fc7e9797da543d319f43ff0917db4c1e5e02

          SHA512

          88c0d6b07d45f906164b2c1178a938ffb56c4fa7288853a02f460339bca026fa58b26a37f52ea846bc205e1828f12f0361d1b0425a1106c8b1a947856d4ee4e4

        • C:\Users\Admin\AppData\Local\Temp\XYLPCO~1.ZIP

          Filesize

          702KB

          MD5

          2a7eb1adf21d776727a66bda5205c246

          SHA1

          538bf0c672575d56c9b1ccc1f0bcffa0ae84ed5a

          SHA256

          8ab9d7ae68a251448a32e68d0fc68204ab766f29d5f74ff43ec7e91ee9b4046b

          SHA512

          79d69104ced64a60b711a4f84e7a0ca596cfc67652eed5351e4a68e0ad36b1336fbafa71cfdb8af4660dfb1f00881f5526b50d7dc3fa1db21240f43881e70fa8

        • C:\Users\Admin\AppData\Local\Temp\larbYbcl.txt

          Filesize

          1.0MB

          MD5

          39587b18ca6dc5a9f91cb76ee3ee0b99

          SHA1

          2ca7ed111b008212d3ec8a63d8ef5a0c9d71d1b5

          SHA256

          05b508103f8f3d634d04cdfb0eaa52ca2be07638a6d23a749888029dc6d1fee5

          SHA512

          b856b6d3e93c11fd988e8d2663109f07cb66d58b1095861d6c8c496a2a4e7ae9ca5070bd40cc233b8e49cc1d30b666c9de3cf6b73311776c85ee36a6082184a3

        • memory/1204-68-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-54-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-79-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-51-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-75-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-81-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-52-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-53-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-74-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-56-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-59-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-55-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-73-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-80-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1204-45-0x0000000004210000-0x00000000042C8000-memory.dmp

          Filesize

          736KB

        • memory/1732-9-0x0000000002520000-0x0000000002521000-memory.dmp

          Filesize

          4KB

        • memory/2444-66-0x0000000000270000-0x0000000000328000-memory.dmp

          Filesize

          736KB

        • memory/2444-39-0x0000000000270000-0x0000000000328000-memory.dmp

          Filesize

          736KB

        • memory/2444-38-0x000007FFFFFD6000-0x000007FFFFFD7000-memory.dmp

          Filesize

          4KB

        • memory/2444-49-0x0000000000270000-0x0000000000328000-memory.dmp

          Filesize

          736KB

        • memory/2468-76-0x0000000001F60000-0x0000000002008000-memory.dmp

          Filesize

          672KB

        • memory/2716-36-0x00000000001F0000-0x000000000023E000-memory.dmp

          Filesize

          312KB

        • memory/2716-44-0x0000000010000000-0x0000000010A12000-memory.dmp

          Filesize

          10.1MB

        • memory/2716-29-0x00000000001F0000-0x000000000023E000-memory.dmp

          Filesize

          312KB

        • memory/2716-28-0x0000000010000000-0x0000000010A12000-memory.dmp

          Filesize

          10.1MB

        • memory/2716-26-0x0000000010000000-0x0000000010A12000-memory.dmp

          Filesize

          10.1MB

        • memory/2716-25-0x0000000010000000-0x0000000010A12000-memory.dmp

          Filesize

          10.1MB

        • memory/2716-27-0x00000000100E6000-0x00000000100EB000-memory.dmp

          Filesize

          20KB

        • memory/2804-65-0x0000000000060000-0x0000000000118000-memory.dmp

          Filesize

          736KB

        • memory/2804-64-0x0000000000060000-0x0000000000118000-memory.dmp

          Filesize

          736KB

        • memory/2804-60-0x0000000000060000-0x0000000000118000-memory.dmp

          Filesize

          736KB