Overview

overview

10

Static

static

3

RX7??????/...??.exe

windows7-x64

7

RX7??????/...??.exe

windows10-1703-x64

10

RX7??????/...??.exe

windows10-2004-x64

7

RX7??????/...??.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    300s
  • max time network
    303s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29-06-2024 11:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RX7??????/RX7??????.exe

  • Size

    9.0MB

  • MD5

    9bb985a8d656695e7145b476f5843d9b

  • SHA1

    692349d245063578785f536eff53e74cb2ed3e8f

  • SHA256

    016c08c41d90c4824da1a0986cb76ff50fd529ad699b6fdb02ce2b9bcdcd7fa1

  • SHA512

    5ea151ae0e88a16e908e5fe5446248095e8aed337617b375dae00cbf01cd7c93153c37315bb20f6579b7a17e908e8f8873577e680a387dc54da535f6c3756430

  • SSDEEP

    98304:bhR4VT3Qs1nkoqshkmafkVsKys31+9KiugFWQJtbGkPQlrW5pDwffds7p8PLC4G/:dmVjTVkoNnekL3wDBP2yiW7LnM/kVa92

Score
10/10
gozibankerdefense_evasionisfbprivilege_escalationtrojanupx

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Blocklisted process makes network request 1 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 12 IoCs
  • Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
    defense_evasionprivilege_escalation
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RX7______\RX7______.exe
    "C:\Users\Admin\AppData\Local\Temp\RX7______\RX7______.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:508
    • C:\Users\Admin\AppData\Local\Temp\RX7______\Liux.exe
      "C:\Users\Admin\AppData\Local\Temp\RX7______\Liux.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\System32\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SJs8Z_S.msi"
        3⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4684
    • C:\Users\Admin\AppData\Local\Temp\RX7______\RX7远程管理.exe
      "C:\Users\Admin\AppData\Local\Temp\RX7______\RX7远程管理.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1736
      • C:\Users\Admin\AppData\Roaming\Load.exe
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4444
  • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
    C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:208
    • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\KGGouWo.exe
      KGGouWo.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1048
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "iex([Text.Encoding]::Default.GetString([Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Internet Explorer').GetValue($null)))"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\SysWOW64\dllhost.exe
          dllhost
          4⤵
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:4168
        • C:\Windows\SysWOW64\dllhost.exe
          dllhost
          4⤵
            PID:4716
          • C:\Windows\SysWOW64\dllhost.exe
            dllhost
            4⤵
              PID:2524
            • C:\Windows\SysWOW64\dllhost.exe
              dllhost
              4⤵
                PID:5072
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Enumerates connected drives
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5012
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 8C14F95C853D3E2299C038AEF2D146FD
            2⤵
            • Drops startup file
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:360
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\SysWOW64\reg.exe" add "HKEY_CLASSES_ROOT\.sysconfig" /ve /d "sysconfig" /f
              3⤵
              • Modifies registry class
              PID:4824
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\SysWOW64\reg.exe" add "HKEY_CLASSES_ROOT\sysconfig\shell\open\command" /ve /d "wscript.exe //E:vbscript ""%1%""" /f
              3⤵
              • Modifies registry class
              PID:4356
          • C:\Windows\Installer\MSI6EAE.tmp
            "C:\Windows\Installer\MSI6EAE.tmp" /EnforcedRunAsAdmin /DontWait /dir "C:\Users\Public\Documents\" regsvr32.exe /s C:\Users\Public\Documents\Properties.dll
            2⤵
            • Executes dropped EXE
            • Access Token Manipulation: Create Process with Token
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:928
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s C:\Users\Public\Documents\Properties.dll
              3⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2592
              • C:\Windows\system32\regsvr32.exe
                /s C:\Users\Public\Documents\Properties.dll
                4⤵
                • Loads dropped DLL
                • Enumerates connected drives
                • Modifies data under HKEY_USERS
                • Suspicious use of SetWindowsHookEx
                PID:1592

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Access Token Manipulation

        1
        T1134

        Create Process with Token

        1
        T1134.002

        Defense Evasion

        Access Token Manipulation

        1
        T1134

        Create Process with Token

        1
        T1134.002

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Query Registry

        3
        T1012

        Peripheral Device Discovery

        1
        T1120

        System Information Discovery

        3
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\e5767c5.rbs
          Filesize

          1KB

          MD5

          cf9ff46b31c7906033ac6ba94f00486c

          SHA1

          1f3b879e55e46a5aee0bb822c65720a91f516f13

          SHA256

          ea5115dd0e7d651e925e4bea33106f346997cdd07681b3440022ea27ca0beb7e

          SHA512

          2ac2ae9efd17f91e6545908e7e0821b005d87eb5093c2dca35cd650e62164d567e0632f2c5001251de2027d1499aea5906f8cbed9897ecf98048d8411286de05

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\KGGouWo.exe
          Filesize

          98KB

          MD5

          2770fcbc1d50ed765b051fb0affe9249

          SHA1

          2242bb12a364598e32b93cbb54dd3c0c0594894c

          SHA256

          cf366c91bd917fe5dbcea610fb8506b657bfebbdc5c74eb99ba8ee0cf458def2

          SHA512

          206ad4d97b81ae10eb711622ae6a5dd4039a59b8498e4be281de207b27025cbf720503f66a3d97f88230f2085e15e94b863a968ed4a41455955fa26210e5cb1f

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
          Filesize

          288KB

          MD5

          13b4967e75327d14361a84faa3c2316d

          SHA1

          2a5ac66f0ec8ab642d5137b4faed376f2f3c684e

          SHA256

          2e93234d52d1332a3aabde393ec66aa1a357336350563f12f29c4285f9946e59

          SHA512

          fd113eaabd451729e2ab87f6aacbf47bbe196c34847b27d115f0f30dc4533d250890647ec1e71cdde40262364eb09cbdc3abc1d19a77664204fe2dc4c042f979

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\RX7______\Liux.exe
          Filesize

          1.4MB

          MD5

          c4efb271c645d5a113c348ffa4b69724

          SHA1

          a6cd25cb6f7b952be89cc86976eb76bb4e6c3c72

          SHA256

          37f48b8f4a5cbe718477001f4869ed04c7f9b8dae7870ab80e7ef36fc00be0c1

          SHA512

          8fb88d24452f14b82aed26ab6aa28d16a4b77b50b75e919e486ade7320513e5fe66a85e8861ffbd6f78bf81c64407078109e97dddda42662d3b0bbd61e93a790

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\RX7______\RX7远程管理.exe
          Filesize

          9.3MB

          MD5

          a8b40d4763f08d51bfed24d0bf258d0a

          SHA1

          2d949f75673e7489ccdabb266134a951dbf5586f

          SHA256

          e4a80728e6f8efdefc6f75560196ceda43d8835b1038feccd6b132cbc6ff6b5b

          SHA512

          7ad834243e35af6ecdafe253bffc7b80d2020737e92ad0a82fbb881fde4506c7e6759e05e114ece6c91eda6f3877d4b6ede4a11d73ec4b20b383648b5f42f5c9

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SJs8Z_S.msi
          Filesize

          1.7MB

          MD5

          1a9ec16d6fa353519ac078f899b404c2

          SHA1

          11d99d3b6de198433fcfb8b22e754af0a3b400f9

          SHA256

          968fbcc7f09c15075a7fe3c7e079c478f4e2a58590bf83141c18328589b6aded

          SHA512

          2a941e12049ed124a058b3cbf6698de7ce3430965ffb5b391340f433f422dda96d788f65643790c9a21f53482577a49b43e3ad3b39a62a805fecb7fc3b76f115

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fihajbg5.i1a.ps1
          Filesize

          1B

          MD5

          c4ca4238a0b923820dcc509a6f75849b

          SHA1

          356a192b7913b04c54574d18c28d46e6395428ab

          SHA256

          6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

          SHA512

          4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

          Download Submit
        • C:\Users\Admin\AppData\Roaming\Load.exe
          Filesize

          1.2MB

          MD5

          e541172f456ea5acf9ccfd33b4051fc1

          SHA1

          60193ac3cb3f6063cf432776c3d8bd22a549bd49

          SHA256

          3badf2601b723bbf99d19027dc0d8756228be0557f45e9b3e2e48fd211bc3823

          SHA512

          f08cbf9d3658a3aa8e7c8d62e49aed80f8cd280d53e074ccc65314d2c9bf940ea7efa567eefa68d7b9af0eb9d5e0720dc83e3da3cfef112458c199353ccac597

          Download Submit
        • C:\Users\Public\Documents\Properties.dll
          Filesize

          731KB

          MD5

          60922574639b3dc592a6b42321dea9f5

          SHA1

          042ae7a3bce4873626a1d86db854566bcbb46fec

          SHA256

          3357eb473e3d2872ff58e832533ba1d615f30503a77d3b4a3960e8d3c5a81ab6

          SHA512

          4f3b0a0b5f9ed3529b1e57d589e4186af1a283abe87151c2da8e4bedb8ee6011c97aeba98b764e1c8199745ace7043df933e23a49ee59fe3d0d8635eb829f98a

          Download Submit
        • C:\Windows\Installer\MSI6810.tmp
          Filesize

          436KB

          MD5

          5788efa607d26332d6d7f5e6a1f6bd6f

          SHA1

          e7749843cc3e89bc81649087de4ad44c93d48bc6

          SHA256

          9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

          SHA512

          ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

          Download Submit
        • C:\Windows\Installer\MSI6EAE.tmp
          Filesize

          389KB

          MD5

          377c83c6f0f37653ff911dc06e6c4274

          SHA1

          ce1e53b5bf0a220346ab7379b93c4341c24fdd8a

          SHA256

          c290a133b60220479acf0469781de847eb7e4a6b0c92de45ee9223be5e0ca769

          SHA512

          47bed026ef3d3e1a88a8cec3e0e2904029ec6f2e0ed9bb8d8836564fa713e882cf9bbf0d1e1dc7887072804578edd6af21b047d579f85f27bba733a20125fdd8

          Download Submit
        • memory/1592-122-0x0000000002B10000-0x0000000002B5E000-memory.dmp
          Filesize

          312KB

          Download
        • memory/1592-130-0x0000000002B10000-0x0000000002B5E000-memory.dmp
          Filesize

          312KB

          Download
        • memory/1592-133-0x0000000002B10000-0x0000000002B5E000-memory.dmp
          Filesize

          312KB

          Download
        • memory/1592-94-0x00007FF864D40000-0x00007FF864E56000-memory.dmp
          Filesize

          1.1MB

          Download
        • memory/1592-132-0x0000000002B10000-0x0000000002B5E000-memory.dmp
          Filesize

          312KB

          Download
        • memory/1592-147-0x00007FF864D40000-0x00007FF864E56000-memory.dmp
          Filesize

          1.1MB

          Download
        • memory/2592-91-0x0000000004BE0000-0x0000000004CF6000-memory.dmp
          Filesize

          1.1MB

          Download
        • memory/2592-165-0x0000000004BE0000-0x0000000004CF6000-memory.dmp
          Filesize

          1.1MB

          Download
        • memory/2616-99-0x0000000008640000-0x000000000868B000-memory.dmp
          Filesize

          300KB

          Download
        • memory/2616-98-0x0000000008460000-0x000000000847C000-memory.dmp
          Filesize

          112KB

          Download
        • memory/2616-100-0x00000000089C0000-0x0000000008A36000-memory.dmp
          Filesize

          472KB

          Download
        • memory/2616-67-0x0000000004E60000-0x0000000004E96000-memory.dmp
          Filesize

          216KB

          Download
        • memory/2616-115-0x000000000A200000-0x000000000A878000-memory.dmp
          Filesize

          6.5MB

          Download
        • memory/2616-116-0x00000000097B0000-0x00000000097CA000-memory.dmp
          Filesize

          104KB

          Download
        • memory/2616-117-0x0000000009870000-0x00000000098E1000-memory.dmp
          Filesize

          452KB

          Download
        • memory/2616-69-0x0000000007AE0000-0x0000000008108000-memory.dmp
          Filesize

          6.2MB

          Download
        • memory/2616-97-0x0000000008110000-0x0000000008460000-memory.dmp
          Filesize

          3.3MB

          Download
        • memory/2616-96-0x00000000077E0000-0x0000000007846000-memory.dmp
          Filesize

          408KB

          Download
        • memory/2616-95-0x0000000007770000-0x00000000077D6000-memory.dmp
          Filesize

          408KB

          Download
        • memory/2616-93-0x00000000076D0000-0x00000000076F2000-memory.dmp
          Filesize

          136KB

          Download
        • memory/4168-118-0x0000000000E00000-0x0000000000E40000-memory.dmp
          Filesize

          256KB

          Download
        • memory/4168-124-0x0000000000E00000-0x0000000000E40000-memory.dmp
          Filesize

          256KB

          Download
        • memory/4168-123-0x0000000000E00000-0x0000000000E40000-memory.dmp
          Filesize

          256KB

          Download
        • memory/4168-120-0x0000000000E00000-0x0000000000E40000-memory.dmp
          Filesize

          256KB

          Download
        • memory/4168-121-0x0000000000E00000-0x0000000000E40000-memory.dmp
          Filesize

          256KB

          Download
        • memory/4168-119-0x0000000000E00000-0x0000000000E40000-memory.dmp
          Filesize

          256KB

          Download
        • memory/4444-22-0x00000000007B0000-0x00000000007B1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/5072-125-0x0000000000E00000-0x0000000000E1C000-memory.dmp
          Filesize

          112KB

          Download
        • memory/5072-126-0x0000000000E00000-0x0000000000E1C000-memory.dmp
          Filesize

          112KB

          Download
        • memory/5072-159-0x0000000000E00000-0x0000000000E1C000-memory.dmp
          Filesize

          112KB

          Download