gozi_ifsb | b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad

General

Target

b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
Size

304KB
MD5

5fb2e9f4fdadfded6edfab710d77873e
SHA1

21ac99478c495a21dac291e744df345f4949653d
SHA256

b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad
SHA512

aaecaa9c0408766b5ecdbd6605b87b86cfee8a804b13da84a76dd912bb9fcd78347659da6b14a0116688482024398664bd35b3989c1dce18a81617e1f9ac9e89

Score

10^/10

gozi_ifsb banker persistence spyware trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Loads dropped DLL 1 IoCs

Processes:

b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe

pid process

740 b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\corrroxy = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Asfeport\\adsndrt.exe"	Explorer.EXE

Suspicious use of SetThreadContext 4 IoCs

Processes:

b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exeb77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.execontrol.exe

description	pid	process	target process
PID 740 set thread context of 1300	740	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
PID 1300 set thread context of 1516	1300	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	control.exe
PID 1516 set thread context of 1256	1516	control.exe	Explorer.EXE
PID 1516 set thread context of 788	1516	control.exe	rundll32.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Asfeport\adsndrt.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\Microsoft\Asfeport\adsndrt.exe	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exeExplorer.EXE

pid process

1300 b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
1256 Explorer.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1256 Explorer.EXE

pid	process
1300	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
1256	Explorer.EXE

pid	process
1256	Explorer.EXE

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exeb77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.execontrol.exe

pid	process
740	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
1300	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
1516	control.exe
1516	control.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Explorer.EXE

pid process

1256 Explorer.EXE

pid	process
1256	Explorer.EXE

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exeb77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.execontrol.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 740 wrote to memory of 1300	740	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
PID 740 wrote to memory of 1300	740	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
PID 740 wrote to memory of 1300	740	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
PID 740 wrote to memory of 1300	740	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
PID 740 wrote to memory of 1300	740	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
PID 1300 wrote to memory of 1516	1300	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	control.exe
PID 1300 wrote to memory of 1516	1300	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	control.exe
PID 1300 wrote to memory of 1516	1300	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	control.exe
PID 1300 wrote to memory of 1516	1300	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	control.exe
PID 1300 wrote to memory of 1516	1300	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	control.exe
PID 1300 wrote to memory of 1516	1300	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	control.exe
PID 1300 wrote to memory of 1516	1300	b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe	control.exe
PID 1516 wrote to memory of 1256	1516	control.exe	Explorer.EXE
PID 1516 wrote to memory of 1256	1516	control.exe	Explorer.EXE
PID 1516 wrote to memory of 1256	1516	control.exe	Explorer.EXE
PID 1516 wrote to memory of 788	1516	control.exe	rundll32.exe
PID 1516 wrote to memory of 788	1516	control.exe	rundll32.exe
PID 1516 wrote to memory of 788	1516	control.exe	rundll32.exe
PID 1516 wrote to memory of 788	1516	control.exe	rundll32.exe
PID 1516 wrote to memory of 788	1516	control.exe	rundll32.exe
PID 1516 wrote to memory of 788	1516	control.exe	rundll32.exe
PID 1256 wrote to memory of 1760	1256	Explorer.EXE	cmd.exe
PID 1256 wrote to memory of 1760	1256	Explorer.EXE	cmd.exe
PID 1256 wrote to memory of 1760	1256	Explorer.EXE	cmd.exe
PID 1760 wrote to memory of 552	1760	cmd.exe	nslookup.exe
PID 1760 wrote to memory of 552	1760	cmd.exe	nslookup.exe
PID 1760 wrote to memory of 552	1760	cmd.exe	nslookup.exe
PID 1256 wrote to memory of 812	1256	Explorer.EXE	cmd.exe
PID 1256 wrote to memory of 812	1256	Explorer.EXE	cmd.exe
PID 1256 wrote to memory of 812	1256	Explorer.EXE	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Local\Temp\b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
"C:\Users\Admin\AppData\Local\Temp\b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:740

C:\Users\Admin\AppData\Local\Temp\b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe
"C:\Users\Admin\AppData\Local\Temp\b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\system32\control.exe
C:\Windows\system32\control.exe /?
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?
5⤵
PID:788

C:\Windows\system32\cmd.exe
cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\4A48.bi1"
2⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\system32\nslookup.exe
nslookup myip.opendns.com resolver1.opendns.com
3⤵
PID:552

C:\Windows\system32\cmd.exe
cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4A48.bi1"
2⤵
PID:812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4A48.bi1
MD5
67a173408db29be821b9fe2421000340

SHA1
71faba974dc8fbbb67fa955142c30fbe0cd149a4

SHA256
b087d5699a034d5a48b918a3aec8b8d8551569332f1f109d5c92177fcceaada8

SHA512
e969d9e43819fdf55ed7588a7df6e2e0a1d8c9ea91444975f5fefaa77155fb7728a94f0ab1bb4a1897e699201c2b1128ae9065c06e1cd57246dd3ae3c7c71671

Download Submit
C:\Users\Admin\AppData\Local\Temp\4A48.bi1
MD5
67a173408db29be821b9fe2421000340

SHA1
71faba974dc8fbbb67fa955142c30fbe0cd149a4

SHA256
b087d5699a034d5a48b918a3aec8b8d8551569332f1f109d5c92177fcceaada8

SHA512
e969d9e43819fdf55ed7588a7df6e2e0a1d8c9ea91444975f5fefaa77155fb7728a94f0ab1bb4a1897e699201c2b1128ae9065c06e1cd57246dd3ae3c7c71671

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Asfeport\adsndrt.exe
MD5
5fb2e9f4fdadfded6edfab710d77873e

SHA1
21ac99478c495a21dac291e744df345f4949653d

SHA256
b77e78b4a11ee81ae30b9db152f77bed8bbaa627dc7af241483d005fd16aa8ad

SHA512
aaecaa9c0408766b5ecdbd6605b87b86cfee8a804b13da84a76dd912bb9fcd78347659da6b14a0116688482024398664bd35b3989c1dce18a81617e1f9ac9e89

Download Submit
\Users\Admin\AppData\Local\Temp\nsc4980.tmp\System.dll
MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
memory/552-18-0x0000000000000000-mapping.dmp

Download
memory/788-11-0x0000000000000000-mapping.dmp

Download
memory/788-14-0x000007FFFFFD4000-mapping.dmp

Download
memory/812-19-0x0000000000000000-mapping.dmp

Download
memory/1300-6-0x0000000000230000-0x000000000026B000-memory.dmp

Filesize
236KB

Download
memory/1300-8-0x00000000000E0000-0x000000000016C000-memory.dmp

Filesize
560KB

Download
memory/1300-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1300-4-0x0000000000401000-mapping.dmp

Download
memory/1300-3-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1516-10-0x00000000022E0000-0x000000000236C000-memory.dmp

Filesize
560KB

Download
memory/1516-9-0x000007FFFFFD7000-mapping.dmp

Download
memory/1516-13-0x00000000025D0000-0x000000000265C000-memory.dmp

Filesize
560KB

Download
memory/1516-7-0x0000000000000000-mapping.dmp

Download
memory/1684-22-0x000007FEF7E50000-0x000007FEF80CA000-memory.dmp

Filesize
2.5MB

Download
memory/1760-17-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads