Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/08/2026, 11:35
General
- Target 2026-08-21_82a2210a91034fc3f56b43cd2ce5473f_amadey_elex_remcos_smoke-loader_stop.exe
- Size 692KB
- Sample260822-nqagwayscx
- SHA256 b7f4c810762e711d142cd5d8814d9a95326c409d02f5296e6d63baeeacd4bedb
Malware Config
Extracted
-
gozi
Extracted
-
gozi
-
91
-
http://aaxvkah7dudzoloq.onion
-
http://mashallah.at
-
http://anumal-planet.at
-
build
217027
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Signatures
- Family: Gozi
Gozi is a well-known and widely distributed banking trojan.
- Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 9 IoCs
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 9 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_82a2210a91034fc3f56b43cd2ce5473f_amadey_elex_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_82a2210a91034fc3f56b43cd2ce5473f_amadey_elex_remcos_smoke-loader_stop.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\control.exeC:\Windows\system32\control.exe /?3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?4⤵
-
-
-
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\FD22.bi1"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\FD22.bi1"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
FD22.bi1
certtlog.exe
memory/1248-25-0x0000000000360000-0x0000000000411000-memory.dmp
memory/1248-77-0x0000000000360000-0x0000000000411000-memory.dmp
memory/1248-21-0x0000000000360000-0x0000000000411000-memory.dmp
memory/1248-20-0x0000000000420000-0x0000000000421000-memory.dmp
memory/1248-15-0x0000000000360000-0x0000000000411000-memory.dmp
memory/2208-73-0x0000019F89B60000-0x0000019F89C11000-memory.dmp
memory/2208-74-0x0000019F89B60000-0x0000019F89C11000-memory.dmp
memory/2208-69-0x0000019F89B60000-0x0000019F89C11000-memory.dmp
memory/3120-24-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-38-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-31-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-35-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-34-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-32-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-79-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-87-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-54-0x0000000003270000-0x0000000003271000-memory.dmp
memory/3120-96-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-37-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-33-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-30-0x0000000003290000-0x0000000003291000-memory.dmp
memory/3120-60-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-88-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-89-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3120-93-0x0000000008E70000-0x0000000008F21000-memory.dmp
memory/3420-61-0x000001908F800000-0x000001908F8B1000-memory.dmp
memory/3420-65-0x000001908F800000-0x000001908F8B1000-memory.dmp
memory/3420-82-0x000001908F800000-0x000001908F8B1000-memory.dmp
memory/3544-90-0x00000000017B0000-0x0000000001854000-memory.dmp
memory/3628-45-0x000001BF1E990000-0x000001BF1E991000-memory.dmp
memory/3628-46-0x000001BF20D20000-0x000001BF20DD1000-memory.dmp
memory/3628-40-0x000001BF20D20000-0x000001BF20DD1000-memory.dmp
memory/3628-80-0x000001BF20D20000-0x000001BF20DD1000-memory.dmp
memory/3900-52-0x000001317C9C0000-0x000001317C9C1000-memory.dmp
memory/3900-53-0x000001317EE40000-0x000001317EEF1000-memory.dmp
memory/3900-47-0x000001317EE40000-0x000001317EEF1000-memory.dmp
memory/3900-81-0x000001317EE40000-0x000001317EEF1000-memory.dmp
memory/4520-55-0x00000237CB8C0000-0x00000237CB971000-memory.dmp
memory/4520-59-0x00000237CB8C0000-0x00000237CB971000-memory.dmp
memory/4704-0-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/4704-1-0x0000000000B60000-0x0000000000B92000-memory.dmp
memory/4704-2-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/4704-12-0x0000000002410000-0x000000000245A000-memory.dmp
memory/4704-5-0x0000000002410000-0x000000000245A000-memory.dmp
memory/4704-23-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/4704-19-0x0000000000B60000-0x0000000000B92000-memory.dmp