Attempts to repeatedly call a single API many times in order to delay analysis time
- Spam:
- Crash:bin (2752) called API GetKeyState 15488 times
- Spam:
- Crash:bin (2752) called API FindResourceExW 124598 times
- Spam:
- aa05e7a187ddec2e11fc1c9eafe61408d085b0ab6cd12caeaf531c9dca129772.exe (2616) called API GetKeyState 15488 times
- Spam:
- aa05e7a187ddec2e11fc1c9eafe61408d085b0ab6cd12caeaf531c9dca129772.exe (2616) called API FindResourceExW 124598 times
Queries for the computername
| PID |
API |
Arguments |
| 2996 |
GetComputerNameW |
- computer_name:
- VIRTUAL-PC
|
One or more AV tool detects this sample as malicious: Trojan:Win32/Gozi.RA!MTB
- Description:
- Trojan:Win32/Gozi.RA!MTB
This executable's signature is valid
This executable is signed
Creates executable files on the filesystem
- File:
- C:\Windows\System32\Crash.exe
Reads data out of its own binary image
- Self Read:
- process: aa05e7a187ddec2e11fc1c9eafe61408d085b0ab6cd12caeaf531c9dca129772.exe, pid: 2616, offset: 0x00000000, length: 0x00113390
- Self Read:
- process: Crash:bin, pid: 2752, offset: 0x00000000, length: 0x00113390
Allocates read-write-execute memory (usually to unpack itself)
| PID |
API |
Arguments |
| 2616 |
NtAllocateVirtualMemory |
- process_identifier:
- 2616
- region_size:
- 65536
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- base_address:
- 0x00360000
- allocation_type:
- 12288
- process_handle:
- 0xffffffff
|
| 2616 |
NtAllocateVirtualMemory |
- process_identifier:
- 2616
- region_size:
- 61440
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- base_address:
- 0x00370000
- allocation_type:
- 12288
- process_handle:
- 0xffffffff
|
| 2616 |
NtProtectVirtualMemory |
- process_identifier:
- 2616
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- length:
- 69632
- protection:
- 64
- base_address:
- 0x00400000
- process_handle:
- 0xffffffff
|
| 2752 |
NtAllocateVirtualMemory |
- process_identifier:
- 2752
- region_size:
- 65536
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- base_address:
- 0x00820000
- allocation_type:
- 12288
- process_handle:
- 0xffffffff
|
| 2752 |
NtAllocateVirtualMemory |
- process_identifier:
- 2752
- region_size:
- 61440
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- protection:
- 64
- base_address:
- 0x00830000
- allocation_type:
- 12288
- process_handle:
- 0xffffffff
|
| 2752 |
NtProtectVirtualMemory |
- process_identifier:
- 2752
- stack_dep_bypass:
- 0
- stack_pivoted:
- 0
- heap_dep_bypass:
- 0
- length:
- 69632
- protection:
- 64
- base_address:
- 0x00400000
- process_handle:
- 0xffffffff
|
Creates an Alternate Data Stream (ADS)
- File:
- C:\Users\Virtual\AppData\Roaming\Crash:bin
Attempts to delete volume shadow copies
| PID |
API |
Arguments |
| 2752 |
CreateServiceW |
- service_start_name:
- start_type:
- 3
- password:
- display_name:
- Crash
- filepath:
- C:\Windows\System32\Crash.exe -s
- service_name:
- Crash
- filepath_r:
- C:\Windows\system32\Crash.exe -s
- desired_access:
- 983551
- service_handle:
- 0x0097e988
- error_control:
- 0
- service_type:
- 16
- service_manager_handle:
- 0x0097eb18
|
This sample contains low entropy sections
- Section:
- .rdata, at virtual address 0x000f2000
- Entropy:
- 0.0336574747211
- Section:
- .data, at virtual address 0x000ff000
- Entropy:
- 0.374652034886
Strings possibly contain hardcoded URLs
- Possible Url:
- https://www.digicert.com/CPS0
- Possible Url:
- http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
- Possible Url:
- http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
- Possible Url:
- http://ocsp.digicert.com0A
- Possible Url:
- http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
- Possible Url:
- http://www.digicert.com/ssl-cps-repository.htm0
- Possible Url:
- http://ocsp.digicert.com0C
- Possible Url:
- http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
- Possible Url:
- http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
- Possible Url:
- http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
- Possible Url:
- https://www.example.com/my_product/info.html0
A process created a hidden window
- Process:
- aa05e7a187ddec2e11fc1c9eafe61408d085b0ab6cd12caeaf531c9dca129772.exe -> C:\Users\Virtual\AppData\Roaming\Crash:bin -r
- Process:
- aa05e7a187ddec2e11fc1c9eafe61408d085b0ab6cd12caeaf531c9dca129772.exe -> cmd /c choice /t 10 /d y & attrib -h "C:\Users\Virtual\AppData\Local\Temp\aa05e7a187ddec2e11fc1c9eafe61408d085b0ab6cd12caeaf531c9dca129772.exe" & del "C:\Users\Virtual\AppData\Local\Temp\aa05e7a187ddec2e11fc1c9eafe61408d085b0ab6cd12caeaf531c9dca129772.exe"
- Process:
- Crash:bin -> C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
- Process:
- Crash:bin -> C:\Windows\system32\takeown.exe /F C:\Windows\system32\Crash.exe
- Process:
- Crash:bin -> C:\Windows\system32\icacls.exe C:\Windows\system32\Crash.exe /reset
- Process:
- Crash:bin -> cmd /c choice /t 10 /d y & attrib -h "C:\Users\Virtual\AppData\Roaming\Crash" & del "C:\Users\Virtual\AppData\Roaming\Crash"
Deletes its original binary from disk
- File:
- C:\Users\Virtual\AppData\Local\Temp\aa05e7a187ddec2e11fc1c9eafe61408d085b0ab6cd12caeaf531c9dca129772.exe
