gozi_ifsb | 7c15e84b317262bc0b881045a322507978ef145d92f2ef3952b5f8b4536a98d8

General

Target

2.rsp.dat.dll
Size

249KB
MD5

8496f33552713183446511bbb2304e22
SHA1

6ed08afb63e2ba64052e1833fcf00f920f6594bb
SHA256

691738533c4ee487b0da4a8fa27ea1e9739a3b10a74c11b1b7435eab586d3742
SHA512

9c96dd893ddbc473b23270340608f32a24178fa0c7b961bb17d4e93d2e4830bb7eb3f793974c4533a593b9a91db4b311fe718ccbd1f2ab0a6950e4efb67de3d0

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000cb961fc52ddebf5a36f934024cd405a5b0e6999aff73ee89081abc164d2f001c000000000e8000000002000020000000aa541648e0c537c46cacc64ec15c705954a665e5628ffcde25c1404126554c7590000000da1c854bf0d73665dcb4fb81c07104dabde197e8cf7a139c4327ed2560695fbdfd6f9259ec9d195d090e25012edd0a58cd84c16c62892cb291aa85cc3cd7730cc324d1dbdae6ea2eaa098238d85aaa8dbe206ca0b313dbc8692d69162093a8828d1af34833a771434b01a9b1f365dfdaa94e958b2279bd9313da9979320a165440cb1ced7344c800d47ffcf8fb5c9a0e40000000d3145c4e2f357d269deb716258388d91657a2506c7003cd59f61db9882dad81fd2198a813924e69c276683d1a601e3b1c9947aeb7535b905f603413238ab4991	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE4C74A1-3886-11EB-A10A-5A5B5EF0CC06} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a60000000000200000000001066000000010000200000006181e0056c191ebfb9b15b10ef8f64ea22463bb1ae3d6a9964b1c81a16030009000000000e8000000002000020000000fb8d96c0400749241b169022fd3763a8aa4f46571cd3c90ea9d1bba2fb88c63c20000000e156567768b4d6dd56a83f6a8fb9bf8a9979888edcd1124fa7bc9f00bebf7efc40000000e31166f4d5937e6a137f1179de7c0f62a3f8c3fd41ad31b2bf1b8254c87772b4508d9e5f6ca063b5d81ef24adff56f90cd24463c9ab3dce4498dc22288380f1f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1071a3c593ccd601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

600 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

600 iexplore.exe
600 iexplore.exe
612 IEXPLORE.EXE
612 IEXPLORE.EXE

pid	process
600	iexplore.exe

pid	process
600	iexplore.exe
600	iexplore.exe
612	IEXPLORE.EXE
612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exeiexplore.exe

description	pid	process	target process
PID 1756 wrote to memory of 1896	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1896	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1896	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1896	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1896	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1896	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1896	1756	rundll32.exe	rundll32.exe
PID 600 wrote to memory of 612	600	iexplore.exe	IEXPLORE.EXE
PID 600 wrote to memory of 612	600	iexplore.exe	IEXPLORE.EXE
PID 600 wrote to memory of 612	600	iexplore.exe	IEXPLORE.EXE
PID 600 wrote to memory of 612	600	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.rsp.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.rsp.dat.dll,#1
2⤵
PID:1896

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:600 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-6-0x0000000000000000-mapping.dmp

Download
memory/612-8-0x0000000006BE0000-0x0000000006BE8000-memory.dmp

Filesize
32KB

Download
memory/612-7-0x0000000005FE0000-0x0000000006003000-memory.dmp

Filesize
140KB

Download
memory/1500-5-0x000007FEF7EB0000-0x000007FEF812A000-memory.dmp

Filesize
2.5MB

Download
memory/1896-0-0x0000000000000000-mapping.dmp

Download
memory/1896-3-0x0000000073540000-0x000000007354F000-memory.dmp

Filesize
60KB

Download
memory/1896-4-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing