Resubmissions
23/03/2026, 17:51
260323-wffj5sdt6n23/03/2026, 16:44
260323-t81dxabt4l20/02/2026, 14:20
260220-rnr6pacy5c19/02/2026, 20:17
260219-y27a4adz4f1019/02/2026, 20:04
260219-ytfheac14a1018/02/2026, 12:33
260218-prjydads9b10Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
18/02/2026, 12:33
General
- Target Supernova/155713f28c8ddb04005519f13b11059f6155e3b5052a47d06cc9ac322a83ef9a.exe
- Size 10.2MB
- Sample260218-prjydads9b
- SHA256 155713f28c8ddb04005519f13b11059f6155e3b5052a47d06cc9ac322a83ef9a
Malware Config
Extracted
-
gozi
Signatures
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Gozi family
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 3 IoCs
- Themida packer 12 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Supernova\155713f28c8ddb04005519f13b11059f6155e3b5052a47d06cc9ac322a83ef9a.exe"C:\Users\Admin\AppData\Local\Temp\Supernova\155713f28c8ddb04005519f13b11059f6155e3b5052a47d06cc9ac322a83ef9a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\Supernova\155713f28c8ddb04005519f13b11059f6155e3b5052a47d06cc9ac322a83ef9a.exe', 'C:\Users\Admin\AppData\Local', 'C:\Users\Admin\AppData\Roaming', 'C:\Users\Admin\AppData\Local', 'C:\Users\Admin\AppData\Roaming'); Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\Supernova\155713f28c8ddb04005519f13b11059f6155e3b5052a47d06cc9ac322a83ef9a.exe'; Add-MpPreference -ExclusionProcess 'TMP_045381.exe'; Add-MpPreference -ExclusionProcess 'IsReadOnly.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Local\Temp\\TMP_045381.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TMP_045381.exe"C:\Users\Admin\AppData\Local\Temp\TMP_045381.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Value\ytvrmwvop\IsReadOnly.exeC:\Users\Admin\AppData\Local\Value\ytvrmwvop\IsReadOnly.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Value\ytvrmwvop\IsReadOnly.exeC:\Users\Admin\AppData\Local\Value\ytvrmwvop\IsReadOnly.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
TMP_045381.exe
__PSScriptPolicyTest_u23dojz4.tk5.ps1
memory/892-3889-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/892-1980-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/892-1983-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/892-1984-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/1408-5804-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/1408-3893-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/1408-5818-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/1408-3897-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/1408-3896-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/2856-55-0x000001E2E8580000-0x000001E2E8592000-memory.dmp
memory/2856-54-0x000001E2E84C0000-0x000001E2E84CC000-memory.dmp
memory/3128-28-0x0000000000400000-0x0000000001628000-memory.dmp
memory/3128-37-0x00007FF9F4430000-0x00007FF9F44ED000-memory.dmp
memory/3128-39-0x0000000003800000-0x000000000380C000-memory.dmp
memory/3128-7-0x0000000000400000-0x0000000001628000-memory.dmp
memory/3128-6-0x0000000000400000-0x0000000001628000-memory.dmp
memory/3128-1971-0x0000000000400000-0x0000000001628000-memory.dmp
memory/3128-1970-0x00007FF9F4430000-0x00007FF9F44ED000-memory.dmp
memory/3128-3-0x00007FF9F4430000-0x00007FF9F44ED000-memory.dmp
memory/3128-2-0x00007FF9F4430000-0x00007FF9F44ED000-memory.dmp
memory/3128-1-0x00007FF9F444A000-0x00007FF9F444B000-memory.dmp
memory/3128-0-0x0000000000400000-0x0000000001628000-memory.dmp
memory/3128-40-0x0000000020450000-0x0000000020982000-memory.dmp
memory/3700-128-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-96-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-59-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/3700-60-0x000000001C8B0000-0x000000001C97A000-memory.dmp
memory/3700-64-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-160-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-164-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-176-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-174-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-172-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-170-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-167-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-168-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-162-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-158-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-156-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-154-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-152-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-148-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-146-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-144-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-142-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-140-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-136-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-134-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-132-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-130-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-52-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/3700-126-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-124-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-120-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-118-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-116-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-114-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-112-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-110-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-108-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-104-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-102-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-100-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-98-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-58-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/3700-94-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-92-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-90-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-88-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-86-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-82-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-80-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-78-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-76-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-74-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-72-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-70-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-68-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-66-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-151-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-138-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-62-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-122-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-106-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-61-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-84-0x000000001C8B0000-0x000000001C975000-memory.dmp
memory/3700-1965-0x000000001C980000-0x000000001C9D6000-memory.dmp
memory/3700-1966-0x000000001C9E0000-0x000000001CA2C000-memory.dmp
memory/3700-1977-0x0000000000400000-0x00000000010D2000-memory.dmp
memory/3700-1972-0x000000001DC30000-0x000000001DC84000-memory.dmp
memory/5076-24-0x00000256AF340000-0x00000256AF3F3000-memory.dmp
memory/5076-36-0x0000025696CE0000-0x0000025696CF2000-memory.dmp
memory/5076-29-0x00000256AF650000-0x00000256AF66A000-memory.dmp
memory/5076-27-0x00000256AEFD0000-0x00000256AEFDA000-memory.dmp
memory/5076-26-0x00000256AEFF0000-0x00000256AF00C000-memory.dmp
memory/5076-25-0x00000256AEF90000-0x00000256AEF9A000-memory.dmp
memory/5076-16-0x00007FF9F4430000-0x00007FF9F44ED000-memory.dmp
memory/5076-30-0x00000256AEFE0000-0x00000256AEFE8000-memory.dmp
memory/5076-31-0x00000256AF010000-0x00000256AF016000-memory.dmp
memory/5076-15-0x0000025696DD0000-0x0000025696DF2000-memory.dmp
memory/5076-8-0x00007FF9F4430000-0x00007FF9F44ED000-memory.dmp
memory/5076-32-0x00000256AF020000-0x00000256AF02A000-memory.dmp
memory/5076-23-0x00000256AEFA0000-0x00000256AEFBC000-memory.dmp
memory/5076-35-0x0000025695150000-0x000002569515C000-memory.dmp