Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 17:54
Static task
static1
Behavioral task
behavioral1
Sample
5f65108386662cc4780882e06928dd940ea6c75235bf8e4c09079e6e40045326.dll
Resource
win7-20240903-en
General
-
Target
5f65108386662cc4780882e06928dd940ea6c75235bf8e4c09079e6e40045326.dll
-
Size
744KB
-
MD5
d6d4942cd0282dbbb0e34276706e6bab
-
SHA1
90a17a059b290a2d5becbff3ec9fe4dabdfc06ae
-
SHA256
5f65108386662cc4780882e06928dd940ea6c75235bf8e4c09079e6e40045326
-
SHA512
ab028fae00d51822e25e38829ee213905d77e6810cad2339e6b2c54530f235596acd749878ef0a65cf10950f40aa4df45c3c7c8d9550add3069c5cd1734f066c
-
SSDEEP
12288:4GzKiFJSk5OWpk0KQlL7QQDprnF0xfHHlsTRRZC7Emy/Kt28nxub/lgkjK7l6kXC:9+iFJJ5OWpk0KQh8QD8uPZC7EojvkjKa
Malware Config
Extracted
gozi
Extracted
gozi
7405
signin.microsoft.com
login.microsoft.com
linerstats.com
linerstats.bar
infeetic.co
-
base_path
/includes/
-
build
250190
-
dns_servers
107.174.86.134
107.175.127.22
-
exe_type
loader
-
extension
.img
-
server_id
12
Signatures
-
Gozi family
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504997a4d153db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000042e7dba96731da408b68fe0ed5b0a24600000000020000000000106600000001000020000000b8902fb283772792875b3d65d1dd69963492024c60edb9552f8f1cd6a7243257000000000e8000000002000020000000918e11c0d6a3343e665bfd2623403a13131c01de70e8a10d359969ae6a86ef5a20000000da3496854f8e8ffe1c82e5148bbd8409f728ec81fe2c36fd74f501c6c824e5fb40000000123bc60ba57067cb4d9093d82d3bfce3d1f70201bccf7e218636c108bc348e92c2c1cca0114e387022d36b76f3d46f5c549ba77f725cd48183b6c26e78bc2baa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2626855347" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C8350098-BFC4-11EF-91C3-EE8B2F3CE00B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2626855347" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000042e7dba96731da408b68fe0ed5b0a246000000000200000000001066000000010000200000003af577667392174af1dd67f186771dff91065511adeaf0a9abe6a57075a7fdcf000000000e8000000002000020000000371f2aeefa48168eb387901a3b88d64b34608d15f1936645440eeec63041f4d120000000277770458ee4d354f4a4f15b08a7444812d823872af54107a557451a2eb70a99400000001e04ba000c271055b9f83561bf878d386019e7a456687bd99a03f449c9b35306e86a504d955e05b848c04bb5323bb86287ecb05df4f9683c059842166a28b891 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e4ab9dd153db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E1B4EA6F-BFC4-11EF-91C3-EE8B2F3CE00B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31151057" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b8a49dd153db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31151057" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000042e7dba96731da408b68fe0ed5b0a246000000000200000000001066000000010000200000003237dddf8018c71e3a985f9a1946b009b3a386f0b2432e51f3e8aefc551a4fb6000000000e80000000020000200000002240a21a7a4b5072c96b5ed941ccc6ecc597ace8265209bffc1b8b060a2eab272000000029b8c4c46ab2f18c21a5a80d69b7c4f51190b74029c0db61cb958cfe4370bd4b40000000499dbcb4786fa9a3267af727bd5ae714aa04ed224d17bd6e7a4f1f2c8e9e54456f7fbedca2ac9b19c006050b19e32c6fe3a683b9b588415af3c326abb12ba750 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1888 iexplore.exe 4856 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1888 iexplore.exe 1888 iexplore.exe 4388 IEXPLORE.EXE 4388 IEXPLORE.EXE 4856 iexplore.exe 4856 iexplore.exe 4524 IEXPLORE.EXE 4524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1588 wrote to memory of 2164 1588 rundll32.exe 82 PID 1588 wrote to memory of 2164 1588 rundll32.exe 82 PID 1588 wrote to memory of 2164 1588 rundll32.exe 82 PID 2164 wrote to memory of 1416 2164 rundll32.exe 83 PID 2164 wrote to memory of 1416 2164 rundll32.exe 83 PID 2164 wrote to memory of 1416 2164 rundll32.exe 83 PID 2164 wrote to memory of 1920 2164 rundll32.exe 85 PID 2164 wrote to memory of 1920 2164 rundll32.exe 85 PID 2164 wrote to memory of 1920 2164 rundll32.exe 85 PID 1888 wrote to memory of 4388 1888 iexplore.exe 108 PID 1888 wrote to memory of 4388 1888 iexplore.exe 108 PID 1888 wrote to memory of 4388 1888 iexplore.exe 108 PID 4856 wrote to memory of 4524 4856 iexplore.exe 111 PID 4856 wrote to memory of 4524 4856 iexplore.exe 111 PID 4856 wrote to memory of 4524 4856 iexplore.exe 111
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f65108386662cc4780882e06928dd940ea6c75235bf8e4c09079e6e40045326.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f65108386662cc4780882e06928dd940ea6c75235bf8e4c09079e6e40045326.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd rose C3⤵
- System Location Discovery: System Language Discovery
PID:1416
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd dicti3⤵
- System Location Discovery: System Language Discovery
PID:1920
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:1812
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4388
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4856 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4524
-