gozi_ifsb | ccecbbaf6bdd8b83cb5966dc1e8f6157aea6a22274166fb7c10f194ad28f4277

General

Target

gye1.cab.dll
Size

632KB
MD5

e78b3e5f216b0fc21a528a1a4de83a39
SHA1

91d536c3667177f95b1713b563d54a1437bf27d5
SHA256

4eed17645ed997121a95459508067a23459d1e36f43d50f672f198e9d117cc2c
SHA512

b56548d765c9f0fcc0f65b4f283b406ce8b4f70c8b6b3a0845299075b8bc7ae1b60032cd7fb40f69ba855767e3304904c8ce413bbdb4cc4773df439256deadeb

Score

10^/10

gozi_ifsb banker persistence spyware trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

ServiceHost packer 2 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/2940-6-0x000000869D1F9000-mapping.dmp	servicehost
behavioral2/memory/3924-26-0x0000000000BB6CD0-mapping.dmp	servicehost

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\adrcProv = "rundll32 \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AuthgLib\\accerLib.dll\",DllRegisterServer"	Explorer.EXE

Suspicious use of SetThreadContext 6 IoCs

Processes:

regsvr32.execontrol.exeExplorer.EXE

description	pid	process	target process
PID 1052 set thread context of 2940	1052	regsvr32.exe	control.exe
PID 2940 set thread context of 2828	2940	control.exe	Explorer.EXE
PID 2828 set thread context of 3556	2828	Explorer.EXE	RuntimeBroker.exe
PID 2940 set thread context of 3124	2940	control.exe	rundll32.exe
PID 2828 set thread context of 2536	2828	Explorer.EXE	WinMail.exe
PID 2828 set thread context of 3924	2828	Explorer.EXE	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeExplorer.EXE

pid process

1052 regsvr32.exe
1052 regsvr32.exe
2828 Explorer.EXE
2828 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

regsvr32.execontrol.exeExplorer.EXE

pid process

1052 regsvr32.exe
2940 control.exe
2828 Explorer.EXE
2940 control.exe
2828 Explorer.EXE
2828 Explorer.EXE

pid	process
1052	regsvr32.exe
1052	regsvr32.exe
2828	Explorer.EXE
2828	Explorer.EXE

pid	process
1052	regsvr32.exe
2940	control.exe
2828	Explorer.EXE
2940	control.exe
2828	Explorer.EXE
2828	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	2828	Explorer.EXE
Token: SeCreatePagefilePrivilege	2828	Explorer.EXE
Token: SeShutdownPrivilege	2828	Explorer.EXE
Token: SeCreatePagefilePrivilege	2828	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Explorer.EXE

pid process

2828 Explorer.EXE

pid	process
2828	Explorer.EXE

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

regsvr32.exeregsvr32.execontrol.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 3372 wrote to memory of 1052	3372	regsvr32.exe	regsvr32.exe
PID 3372 wrote to memory of 1052	3372	regsvr32.exe	regsvr32.exe
PID 3372 wrote to memory of 1052	3372	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 2940	1052	regsvr32.exe	control.exe
PID 1052 wrote to memory of 2940	1052	regsvr32.exe	control.exe
PID 1052 wrote to memory of 2940	1052	regsvr32.exe	control.exe
PID 1052 wrote to memory of 2940	1052	regsvr32.exe	control.exe
PID 1052 wrote to memory of 2940	1052	regsvr32.exe	control.exe
PID 2940 wrote to memory of 2828	2940	control.exe	Explorer.EXE
PID 2940 wrote to memory of 2828	2940	control.exe	Explorer.EXE
PID 2940 wrote to memory of 2828	2940	control.exe	Explorer.EXE
PID 2940 wrote to memory of 3124	2940	control.exe	rundll32.exe
PID 2940 wrote to memory of 3124	2940	control.exe	rundll32.exe
PID 2940 wrote to memory of 3124	2940	control.exe	rundll32.exe
PID 2828 wrote to memory of 3556	2828	Explorer.EXE	RuntimeBroker.exe
PID 2828 wrote to memory of 3556	2828	Explorer.EXE	RuntimeBroker.exe
PID 2828 wrote to memory of 3556	2828	Explorer.EXE	RuntimeBroker.exe
PID 2940 wrote to memory of 3124	2940	control.exe	rundll32.exe
PID 2940 wrote to memory of 3124	2940	control.exe	rundll32.exe
PID 2828 wrote to memory of 2180	2828	Explorer.EXE	cmd.exe
PID 2828 wrote to memory of 2180	2828	Explorer.EXE	cmd.exe
PID 2180 wrote to memory of 3908	2180	cmd.exe	nslookup.exe
PID 2180 wrote to memory of 3908	2180	cmd.exe	nslookup.exe
PID 2828 wrote to memory of 1404	2828	Explorer.EXE	cmd.exe
PID 2828 wrote to memory of 1404	2828	Explorer.EXE	cmd.exe
PID 2828 wrote to memory of 2536	2828	Explorer.EXE	WinMail.exe
PID 2828 wrote to memory of 2536	2828	Explorer.EXE	WinMail.exe
PID 2828 wrote to memory of 2536	2828	Explorer.EXE	WinMail.exe
PID 2828 wrote to memory of 2536	2828	Explorer.EXE	WinMail.exe
PID 2828 wrote to memory of 2536	2828	Explorer.EXE	WinMail.exe
PID 2828 wrote to memory of 3924	2828	Explorer.EXE	cmd.exe
PID 2828 wrote to memory of 3924	2828	Explorer.EXE	cmd.exe
PID 2828 wrote to memory of 3924	2828	Explorer.EXE	cmd.exe
PID 2828 wrote to memory of 3924	2828	Explorer.EXE	cmd.exe
PID 2828 wrote to memory of 3924	2828	Explorer.EXE	cmd.exe
PID 2828 wrote to memory of 3924	2828	Explorer.EXE	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\gye1.cab.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:3372

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\gye1.cab.dll
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\system32\control.exe
C:\Windows\system32\control.exe /?
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?
5⤵
PID:3124

C:\Windows\system32\cmd.exe
cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\534C.bi1"
2⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\system32\nslookup.exe
nslookup myip.opendns.com resolver1.opendns.com
3⤵
PID:3908

C:\Windows\system32\cmd.exe
cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\534C.bi1"
2⤵
PID:1404

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
2⤵
PID:2536

C:\Windows\syswow64\cmd.exe
"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
2⤵
PID:3924

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\534C.bi1
MD5
67a173408db29be821b9fe2421000340

SHA1
71faba974dc8fbbb67fa955142c30fbe0cd149a4

SHA256
b087d5699a034d5a48b918a3aec8b8d8551569332f1f109d5c92177fcceaada8

SHA512
e969d9e43819fdf55ed7588a7df6e2e0a1d8c9ea91444975f5fefaa77155fb7728a94f0ab1bb4a1897e699201c2b1128ae9065c06e1cd57246dd3ae3c7c71671

Download Submit
C:\Users\Admin\AppData\Local\Temp\534C.bi1
MD5
67a173408db29be821b9fe2421000340

SHA1
71faba974dc8fbbb67fa955142c30fbe0cd149a4

SHA256
b087d5699a034d5a48b918a3aec8b8d8551569332f1f109d5c92177fcceaada8

SHA512
e969d9e43819fdf55ed7588a7df6e2e0a1d8c9ea91444975f5fefaa77155fb7728a94f0ab1bb4a1897e699201c2b1128ae9065c06e1cd57246dd3ae3c7c71671

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AuthgLib\accerLib.dll
MD5
e78b3e5f216b0fc21a528a1a4de83a39

SHA1
91d536c3667177f95b1713b563d54a1437bf27d5

SHA256
4eed17645ed997121a95459508067a23459d1e36f43d50f672f198e9d117cc2c

SHA512
b56548d765c9f0fcc0f65b4f283b406ce8b4f70c8b6b3a0845299075b8bc7ae1b60032cd7fb40f69ba855767e3304904c8ce413bbdb4cc4773df439256deadeb

Download Submit
memory/1052-3-0x0000000000C50000-0x0000000000C9A000-memory.dmp

Filesize
296KB

Download
memory/1052-2-0x0000000000000000-mapping.dmp

Download
memory/1052-5-0x0000000004900000-0x00000000049B3000-memory.dmp

Filesize
716KB

Download
memory/1404-16-0x0000000000000000-mapping.dmp

Download
memory/2180-14-0x0000000000000000-mapping.dmp

Download
memory/2536-21-0x0000003648E01000-mapping.dmp

Download
memory/2536-19-0x0000000000000000-mapping.dmp

Download
memory/2828-20-0x0000000005790000-0x0000000005843000-memory.dmp

Filesize
716KB

Download
memory/2828-11-0x0000000005790000-0x0000000005843000-memory.dmp

Filesize
716KB

Download
memory/2828-25-0x0000000003450000-0x00000000034F5000-memory.dmp

Filesize
660KB

Download
memory/2940-6-0x000000869D1F9000-mapping.dmp

Download
memory/2940-12-0x00000222E4EF0000-0x00000222E4FA3000-memory.dmp

Filesize
716KB

Download
memory/2940-7-0x00000222E2C90000-0x00000222E2D43000-memory.dmp

Filesize
716KB

Download
memory/2940-4-0x0000000000000000-mapping.dmp

Download
memory/3124-10-0x0000000000000000-mapping.dmp

Download
memory/3124-13-0x000000EF89A14000-mapping.dmp

Download
memory/3908-15-0x0000000000000000-mapping.dmp

Download
memory/3924-22-0x0000000000000000-mapping.dmp

Download
memory/3924-23-0x0000000000000000-mapping.dmp

Download
memory/3924-24-0x0000000000BB6CD0-0x0000000000BB6CD4-memory.dmp

Filesize
4B

Download
memory/3924-26-0x0000000000BB6CD0-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads