Analysis
- max time kernel
150s - max time network
103s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 11:35
General
- Target 2026-08-21_82a2210a91034fc3f56b43cd2ce5473f_amadey_elex_remcos_smoke-loader_stop.exe
- Size 692KB
- Sample260822-nqagwayscx
- SHA256 b7f4c810762e711d142cd5d8814d9a95326c409d02f5296e6d63baeeacd4bedb
Malware Config
Extracted
-
gozi
Extracted
-
gozi
-
91
-
http://aaxvkah7dudzoloq.onion
-
http://mashallah.at
-
http://anumal-planet.at
-
build
217027
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
worker
-
server_id
12
Signatures
- Family: Gozi
Gozi is a well-known and widely distributed banking trojan.
- Executes dropped EXE 1 IoCs
- Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 12 IoCs
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 12 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_82a2210a91034fc3f56b43cd2ce5473f_amadey_elex_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_82a2210a91034fc3f56b43cd2ce5473f_amadey_elex_remcos_smoke-loader_stop.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\control.exeC:\Windows\system32\control.exe /?3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?4⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\8050.bi1"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵
- Unexpected DNS network traffic destination
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8050.bi1"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Compbase\ffbrgmsg.exeC:\Users\Admin\AppData\Roaming\Microsoft\Compbase\ffbrgmsg.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\control.exeC:\Windows\system32\control.exe /?2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
8050.bi1
8050.bi1
ffbrgmsg.exe
memory/1188-96-0x0000000000500000-0x00000000005B1000-memory.dmp
memory/1188-104-0x0000000000500000-0x00000000005B1000-memory.dmp
memory/1188-135-0x0000000000500000-0x00000000005B1000-memory.dmp
memory/1956-56-0x0000014610B40000-0x0000014610BF1000-memory.dmp
memory/1956-60-0x0000014610B40000-0x0000014610BF1000-memory.dmp
memory/2484-20-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/2484-15-0x0000000000A00000-0x0000000000AB1000-memory.dmp
memory/2484-62-0x0000000000A00000-0x0000000000AB1000-memory.dmp
memory/2484-27-0x0000000000A00000-0x0000000000AB1000-memory.dmp
memory/2484-21-0x0000000000A00000-0x0000000000AB1000-memory.dmp
memory/3012-144-0x0000000000C00000-0x0000000000CA4000-memory.dmp
memory/3940-91-0x0000000002360000-0x0000000002404000-memory.dmp
memory/3940-86-0x00000000025B0000-0x00000000025FA000-memory.dmp
memory/3940-68-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/3940-94-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/3940-69-0x0000000002360000-0x0000000002404000-memory.dmp
memory/3940-72-0x0000000002360000-0x0000000002404000-memory.dmp
memory/3940-79-0x00000000025B0000-0x00000000025FA000-memory.dmp
memory/3940-74-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/4140-0-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/4140-1-0x0000000002450000-0x0000000002482000-memory.dmp
memory/4140-2-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/4140-37-0x0000000000400000-0x00000000004B4000-memory.dmp
memory/4140-19-0x0000000002450000-0x0000000002482000-memory.dmp
memory/4140-5-0x00000000024D0000-0x000000000251A000-memory.dmp
memory/4140-12-0x00000000024D0000-0x000000000251A000-memory.dmp
memory/4376-45-0x000002B8EFDD0000-0x000002B8EFE81000-memory.dmp
memory/4376-116-0x000002B8EFE90000-0x000002B8EFF41000-memory.dmp
memory/4376-46-0x000002B8EFDD0000-0x000002B8EFE81000-memory.dmp
memory/4376-75-0x000002B8EFDD0000-0x000002B8EFE81000-memory.dmp
memory/4376-120-0x000002B8EFE90000-0x000002B8EFF41000-memory.dmp
memory/4376-44-0x000002B8EE950000-0x000002B8EE951000-memory.dmp
memory/4376-40-0x000002B8EFDD0000-0x000002B8EFE81000-memory.dmp
memory/4376-92-0x000002B8EFDD0000-0x000002B8EFE81000-memory.dmp
memory/4428-47-0x00000194014A0000-0x0000019401551000-memory.dmp
memory/4428-128-0x0000019401560000-0x0000019401611000-memory.dmp
memory/4428-76-0x00000194014A0000-0x0000019401551000-memory.dmp
memory/4428-54-0x00000194014A0000-0x0000019401551000-memory.dmp
memory/4428-53-0x0000019401410000-0x0000019401411000-memory.dmp
memory/4428-132-0x0000019401560000-0x0000019401611000-memory.dmp
memory/4428-93-0x00000194014A0000-0x0000019401551000-memory.dmp
memory/4508-126-0x00000235B5840000-0x00000235B58F1000-memory.dmp
memory/4508-122-0x00000235B5840000-0x00000235B58F1000-memory.dmp
memory/4508-134-0x00000235B5840000-0x00000235B58F1000-memory.dmp
memory/5316-32-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-141-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-31-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-113-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-22-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-89-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-112-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-114-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-111-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-110-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-109-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-73-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-50-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-30-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-105-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-64-0x00000000038E0000-0x00000000038E1000-memory.dmp
memory/5316-33-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-133-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-127-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-88-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-34-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-35-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-38-0x00000000034F0000-0x00000000034F1000-memory.dmp
memory/5316-87-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-142-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-143-0x0000000005320000-0x00000000053D1000-memory.dmp
memory/5316-39-0x00000000039F0000-0x0000000003AA1000-memory.dmp
memory/5316-147-0x0000000005320000-0x00000000053D1000-memory.dmp