Overview

overview

10

Static

static

setup.exe

windows7_x64

10

setup.exe

windows10_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    08/07/2020, 13:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 175KB
  • Sample200708-9lpba7fbpx
  • SHA256 f646b963da9c039c682f75c76ab369956e63804aeea00561e448fb26ca5751d3
  • MD5 SHA1 SHA512
Score
10/10
bankertrojangozi_ifsb

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 102 IoCs
    adwarespyware
  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Suspicious use of WriteProcessMemory 35 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Checks whether UAC is enabled 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
      PID:1544
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Checks whether UAC is enabled
      PID:1032
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:275457 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Checks whether UAC is enabled
        PID:1748
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:668677 /prefetch:2
        2⤵
          PID:1640
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        PID:1944
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1944 CREDAT:275457 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:2004
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        PID:1868
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:1836
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        PID:1028
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1028 CREDAT:275457 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:1124

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1544-0-0x0000000003420000-0x0000000003421000-memory.dmp
            Download

            memory/1544-1-0x0000000004E20000-0x0000000004E31000-memory.dmp
            Download

            memory/1748-3-0x0000000005C20000-0x0000000005C43000-memory.dmp
            Download