gozi | 45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154

Analysis

max time kernel
142s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe
Size

351KB
MD5

a47ee973940ba634ced04939b927e556
SHA1

31f361613a56e26ad3636cef4b51827e54df3c1d
SHA256

45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154
SHA512

8f3e78b45d548b23a889a230062bbfd0e692f3b0eab341954d4a1a86432ff8768b0af14f0005280452d0837756ae628d46fe7ef4983dfc6dc6b464752f73010b
SSDEEP

6144:ViceR0zXvZss0DYWQ9km7LWMCuMeGbfUTpYDDmu/+3fbZ:nzXvZ7p9hLWMCmG+pG/YZ

Score

10^/10

gozi ramnit 8585 banker discovery isfb spyware stealer trojan upx worm

Malware Config

Extracted

Family

gozi

Attributes

build
214131

Extracted

Family

gozi

Botnet

8585

mcc.avast.com

securezza.at

Attributes

build
214131
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe

Loads dropped DLL 2 IoCs

pid	Process
1568	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe
1568	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000120fe-2.dat	upx
behavioral1/memory/1768-12-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1768-16-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1768-14-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1568-8-0x00000000002F0000-0x000000000034D000-memory.dmp	upx
behavioral1/memory/1768-24-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1768-25-0x0000000000400000-0x000000000045D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 63 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000344cd32bde3ada4bab80aa11e5ef0fb80000000002000000000010660000000100002000000087e85e9785e941274d68ed94ba8e0c1bd40b13d09b1455beb298cc4300b1edf0000000000e8000000002000020000000accf07a8f4da4d2a2d2da5ad83a30942970f36b2f49908002999099e5506a7959000000064feb7552831ffad60b89c3ad1d40ece6c59aeaf349cd6e46a7c041526687e18ecc1416a99773d5dde5d4e75b4d56d4a4da26ef341391e547b74ee9f43505ec4df1f7e005338e0134ef3d062ec573bf004615f6478be6fdf07ac15896d32b71137fa2eb5074b741cc74bc4ded1841939290fb3ab8d764461a1a94b018993c8b4796b51ad82935c9091f4183a8f7d3340400000004408ff3ece4cdffaa194284c6735326486ee04e98b5d15b42b7c5977b9c6fdb50351467111bafbf151848acefa5bdef41b25b89a2cfd645c55837cd6a3f39fe3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e3f23f6089db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{642F7851-F553-11EF-8EB4-4E0B11BE40FD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{642BA7C1-F553-11EF-8EB4-4E0B11BE40FD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000344cd32bde3ada4bab80aa11e5ef0fb800000000020000000000106600000001000020000000f28d2c87a5fd0531d745568606f2a78acafcd1a0836f797a656118b30ed06360000000000e800000000200002000000023683ed4f80743965114ab21f2705817c48dbd5bb5eae3aabe6845de00cf1afc20000000323aeb0ccfe236193346766d85431cb180e28f5d98b2e9b247ee899d38e47b6f400000009920ec5427d19045647786275f94cce2e88d7e5a621603cf69dc2bc489be79ab9432e3fc6a04a0ea7d6f61419d074b9518e02755506b49e60714456dffb7b390	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "446854266"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2272	iexplore.exe
1880	iexplore.exe
2272	iexplore.exe
2272	iexplore.exe
2272	iexplore.exe
2272	iexplore.exe
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
1880	iexplore.exe
1880	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2272	iexplore.exe
2272	iexplore.exe
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE
2272	iexplore.exe
2272	iexplore.exe
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE
2272	iexplore.exe
2272	iexplore.exe
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE
2272	iexplore.exe
2272	iexplore.exe
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE
2272	iexplore.exe
2272	iexplore.exe
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1768	1568	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe	30
PID 1568 wrote to memory of 1768	1568	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe	30
PID 1568 wrote to memory of 1768	1568	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe	30
PID 1568 wrote to memory of 1768	1568	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe	30
PID 1768 wrote to memory of 2272	1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	31
PID 1768 wrote to memory of 2272	1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	31
PID 1768 wrote to memory of 2272	1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	31
PID 1768 wrote to memory of 2272	1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	31
PID 1768 wrote to memory of 1880	1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	32
PID 1768 wrote to memory of 1880	1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	32
PID 1768 wrote to memory of 1880	1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	32
PID 1768 wrote to memory of 1880	1768	45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe	32
PID 2272 wrote to memory of 2236	2272	iexplore.exe	33
PID 2272 wrote to memory of 2236	2272	iexplore.exe	33
PID 2272 wrote to memory of 2236	2272	iexplore.exe	33
PID 2272 wrote to memory of 2236	2272	iexplore.exe	33
PID 1880 wrote to memory of 2548	1880	iexplore.exe	34
PID 1880 wrote to memory of 2548	1880	iexplore.exe	34
PID 1880 wrote to memory of 2548	1880	iexplore.exe	34
PID 1880 wrote to memory of 2548	1880	iexplore.exe	34
PID 2272 wrote to memory of 1516	2272	iexplore.exe	38
PID 2272 wrote to memory of 1516	2272	iexplore.exe	38
PID 2272 wrote to memory of 1516	2272	iexplore.exe	38
PID 2272 wrote to memory of 1516	2272	iexplore.exe	38

C:\Users\Admin\AppData\Local\Temp\45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe
"C:\Users\Admin\AppData\Local\Temp\45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\AppData\Local\Temp\45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
  C:\Users\Admin\AppData\Local\Temp\45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:340993 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2236
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275466 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1516
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f45f399f121a73c4e636350d39bb954

SHA1
2326d8f1cef5a421a8ecf6e36bbaa8ee888b2900

SHA256
ddb8fe91163cbac58da565a2de9250abd0dd6a612ebcda9248236bce524279ed

SHA512
1728994167d6c3e3af2433bcfd0d714b0108dfc3e31d56bfba2ed213863b85b0e601f6aeeb8ae4e1ec571f1ce90ff478f5ccf5da1f338b338c99073718934fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
287efae578309b75286ce8fd9fe1be94

SHA1
09039ee80d01d83d087cbe0e783275c23792aa47

SHA256
a7be695133e84647702132ce9c266f69505a89ac4d106593df87154d64fa0fcf

SHA512
1ebf210b88db5907e2ae8af3697016e03bf5b9ce3fcd3e132f396ba6cd3ed65498d3fa2d0db6d1639ca072bb3d2a7e486d978e1e4473bed9e5f12ec7a3b765c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0419173ed2e68b596c1deacef11acfb

SHA1
9731636ebaf93fba15b052d3cea78b04fd1ddf69

SHA256
2aa1d026f885d2c1b5e7819a92840ed404ff5933b6f8fb8681a5990bdda1180b

SHA512
5563e470f4b02b3a42db98598756b2f7904b8727f8524f3b5a218cc0313fff524c7154f0d2afd87a3815bbfed1ec145219986f81755660cf53f5df26fbbc7fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ddd14d1b63784439c9284eb7a38225

SHA1
d57085050d5e64db4ab86b5ad50629415742ce2e

SHA256
80ded01d6a7f4287d04d24bb26bd6bf684e054ae2fac70747ba397889f8128b9

SHA512
fe7be89415da0ad7856071b565d0bacfd640c35e709436a052025168967daf2346c3e4140fcf57fda3b11feafd0dc4d653e88aee609ef1576da7b64c06551540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76b297a1b8387308d5c3ae027ff4e27e

SHA1
7bdfed2c23690bbccebb3aad3dfb0c590749b9a7

SHA256
e92b5495d3a742502f6c9a760aa32d624b76787afaba957ee96f833b6a5d059d

SHA512
987cc96ba2c7822554f11d2121f514fd93272c8af7f5da7a73e547865334334540fab524a8770050824a670def23492104a0643689d442a02dd93da38f56007c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db9a89c62153c187bcf6d9af62dfc43d

SHA1
1552bc8ec7371fc3468fb00af6324602abd83a1b

SHA256
f167f1949ff27ff2334c7244f249d26d996da5d51d904f47e3926b3640699a85

SHA512
f966b0bfab236ce7f67a20e27394c810931a94fd0f6ac7bd0f64ca4cbc95d7552bde40ee9ac33ab286bbe964498ec76de6cc827a28e86eef6093210dfe6b267b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a0d2c6e070ce411da79d45ac9454aaa

SHA1
9bb42a855e3433a5aa99153b871faf1fcd7352e6

SHA256
f7a18bb5a9071eb08ae0f734dd468a661c8387a29e1b990567c79ba3ca498c70

SHA512
d365607dd1867c0fe95a6af1f2cbe2d7f32c6ae16ef9a319600a923e943821e1f6ed5c2e6f2d35501a04a37f95e45c66ff54c38d690c2f08ab08be3d555b177b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa070bc87ce05b098567abe5e87906d7

SHA1
dcbbe858eb97e03239ef928779faad3aadb713e3

SHA256
fece16c6a1f38ef50c1ccec9a5508e9a7e71dd2777088c0030b4f0514d21f91c

SHA512
8bc7577a7c021dcf1618db45164239229fdbff498b5723120001215ae1b0ba8276c07c320da5c022d75fb6a9809da2d44b31c1fe2bba883510727216a07d2744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afda51f8c080411b9f7d82c04082203e

SHA1
e4acd8b1dbf5b2f61b7248223e44a6b394587deb

SHA256
10854243b5e4125b20fb9ba1fbce348be0c5f38fd8611c80fe6eb41076a2a83a

SHA512
f26d6c2f3864663b4d767975a77977bf216586ebd62e64ffd06a3c9b2a62cfc7fa11a335f6197e8384c4a91f1e7d8877966c54fd5d7d58b3709ef3dc7374154c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbd9b1aae4c2beadf0363ae5be43d4b5

SHA1
c98a69b0a818e231ef30e9b3d5c07e06ed900448

SHA256
82078bc5d38425d7cb84d6d06896872305d862c5150302a86db4b34eeefcefbd

SHA512
503b9eacfd2d1d1b86016cc45b6d2ec54ff2b0c952d445d7a3fa2c670bd993858d3b3175a7555a99b58cdfcf1c01c9ab6c7aefb3e56484a889a2cf667a0e60fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e5de0f75adc5f428261e45a8f2f98d6

SHA1
24cdd5b882ceff60cf2919ed37147242c6523b1b

SHA256
82f27b85c8006fd3a85524d7b7d1f3f04310eb451d62b649de5f6fa30bb5fccc

SHA512
e5b6a9ab0d15c16f473bc4f6c65a34fa79fb35938f69d2b89be94092f46f9ad3022a2915beaee6da12e7f14b89a7fe654326c114e0d16a0c4fb0e1ebd73aa324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04b38e75e64d1612f1bd981d3a614b88

SHA1
67410882b1dc5206597ee5555624f37d9d573a5a

SHA256
eab35b3805f05125eafe6d387badba2ba1679739be49596acc396439fc3b13aa

SHA512
d121b84b66b432e7d0b689a7a8b0b0007880961ea8dbca5791527c2cb08894275bb04e7d7f9a6e8fdde49a9c627dbcd1d6f4ce365672181cc0021bd481b88ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
215436b6aa912f986fbfb46eb6580834

SHA1
b443eab859ec31d8dac129bd85ff8c370e628260

SHA256
628a943e72aab21a333ed63a8757f3e5a62ffab42eb12552b629fbcd755571ce

SHA512
1357c4d7f72d5e332ded76cf93f39e58e408cc67da6460a9d235b73eec002747e3134b5af7d360b652f540d709e5ce9d631d3eb0c0626071bdba7a9d438eda94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2931776356e5705a5034135e7e07ab50

SHA1
b7adf69944025417c256a4fcee1fe618b02d769d

SHA256
a79c184eac0e2827566078f6475388a922fac27941085195c98065a046e15686

SHA512
a496047349bbbae16d1c85daaea83218e4addf2837cb9b7ef8f56e3708f93e0f23b60d64f80beaebc1dbe7472b3c6a7dc991fc8ceb408d59cd53c3d16af748cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f42e236d8a7ddfe160d9d247c228395

SHA1
58cd2932bee5dd259174da63f4a739929b478377

SHA256
b6cbf57fc4104e6ac8e02fde6fa1d3fe13514706ea4f3c9a5b0c8c103ea9179b

SHA512
50d7dabe154ddc8ec77be031bff6e0f043baabc477af8aad952b8ff6179a5f2db896439511da91e5e850ab4616bcbbc6bfe9925be3a35113fe43f61e024b4292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3833f5aba3936af56a7365e0a24661cd

SHA1
af9622d8c7b40d713821f701c45215e8bbacb2ad

SHA256
154cbbac12c6242154489c7cf0ee29c66a8ee1314c92424921077e8c9c0361a9

SHA512
0e90e52b51fde6462aba900adcf82874fba949bea148889f19583403c3fdb68da62441dab4c5f4a4d313062da4c6fe4a06459759fad48d9ff57ce4707855cfe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a17f1c9004bc0da0d6dc13af4dee4f16

SHA1
7dfabff9e7260a269368e36b9153136dcca3426d

SHA256
b759f5718a3932716e3eddd02a73df2cd336739f93472ebb7bb1953d92e5bb96

SHA512
9bbbfa48f1960451eacc3903d9d59148817bedd2858a6f2034c5154172a992a835f2b1c33b243911753e74b6e024357982bd50de27202ea23857d45db2fe28c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b482c9b3479884539b188c38acea378d

SHA1
1c24aac3370a55c605b78e601003562be5963152

SHA256
7ad9f0557de059b15ffa430be1ac5c1788d19aa52c706de64619f57f7bb87e03

SHA512
e11868abba393f3e43188280f2538da144576c1bdc3c4d680add45cd3c2009580bbdfd4e4175ac05a416e0200562708d67267eda69f19a77fd91a97a170572a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{642BA7C1-F553-11EF-8EB4-4E0B11BE40FD}.dat

Filesize
5KB

MD5
e0248c3d048d1ebc72d018ee0a65a152

SHA1
8bf4b2e116818a4a2d86e3accfec8acb13f64107

SHA256
d4ca4ae8f9ba8545f151380def038e352ab1a67dac23eb66d65999818ca6cabb

SHA512
bb19fac34a020897313e1c304e46d1b278b2648743c92a5ab3dd7193a7d4c54e74a62a963f72450e74a07f21df9d207c6db5abc2081c3641e0c293cf8805a132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\httpErrorPagesScripts[2]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\NewErrorPageTemplate[1]

Filesize
1KB

MD5
cdf81e591d9cbfb47a7f97a2bcdb70b9

SHA1
8f12010dfaacdecad77b70a3e781c707cf328496

SHA256
204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd

SHA512
977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\dnserror[1]

Filesize
1KB

MD5
73c70b34b5f8f158d38a94b9d7766515

SHA1
e9eaa065bd6585a1b176e13615fd7e6ef96230a9

SHA256
3ebd34328a4386b4eba1f3d5f1252e7bd13744a6918720735020b4689c13fcf4

SHA512
927dcd4a8cfdeb0f970cb4ee3f059168b37e1e4e04733ed3356f77ca0448d2145e1abdd4f7ce1c6ca23c1e3676056894625b17987cc56c84c78e73f60e08fc0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCFEF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD11F.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF7EA133AE5129B9F7.TMP

Filesize
16KB

MD5
247405fb6a90c953862e32ec8ff0d988

SHA1
4ad5192b43e89983a2c476678965d13ed076d150

SHA256
4368e1b050e09b3260aee7c6e6de30ee7fb30548013f95ad1a08e08cd45bca15

SHA512
3c408ae2576053f51a29d36bffdef629916b3072127b5bd0ae968cab35d9574f37c3eefecbb7968313ba7688121aaf2881c8df4dba2b75bce854ca8a9a98988c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

Filesize
3KB

MD5
4384e355e33e51af335433d5ace05220

SHA1
ab8c67d37c8bf99048f3b2e92d0bc1d950e4def5

SHA256
4f5e8cf014fb9bbbeaa7f5edf1e8911ce45912150f3a506554ed9b12ad296e56

SHA512
1e0918eed639090db657926c43295b4b1ef299ea96e80741c6d3e44ea315f223c99221256cf3b64282cb400660bc3b791e9f00697c7486b950db96640a8a1ae4

Download Submit
\Users\Admin\AppData\Local\Temp\45d3c7d1fb1ea66a66cd2895c30e8df398cf561314e1bcac2c429dc273817154mgr.exe

Filesize
105KB

MD5
d5ca6e1f080abc64bbb11e098acbeabb

SHA1
1849634bf5a65e1baddddd4452c99dfa003e2647

SHA256
30193b5ccf8a1834eac3502ef165350ab74b107451145f3d2937fdf24b9eceae

SHA512
aa57ce51de38af6212d7339c4baac543a54b0f527621b0ef9e78eca5e5699e8508a154f54f8ac04135527d8417275eeee72a502a362547575699330cc756b161

Download Submit
memory/1568-19-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/1568-8-0x00000000002F0000-0x000000000034D000-memory.dmp

Filesize
372KB

Download
memory/1568-9-0x00000000002F0000-0x000000000034D000-memory.dmp

Filesize
372KB

Download
memory/1568-22-0x0000000000340000-0x000000000034F000-memory.dmp

Filesize
60KB

Download
memory/1568-0-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/1568-501-0x00000000003D0000-0x00000000003D2000-memory.dmp

Filesize
8KB

Download
memory/1568-20-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/1768-11-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1768-14-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1768-15-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1768-12-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1768-24-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1768-16-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1768-13-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1768-25-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download