gozi_ifsb | 9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7

Target

b5b2765aaf97ae9c22abd312e684616d.dll
Size

820KB
MD5

b5b2765aaf97ae9c22abd312e684616d
SHA1

a66a652c2067f7489b83aba3b78502c0f482863b
SHA256

9f6d02b422cb72eb3bbc723b8b4a692bc9f641f1908b7e4b32685b2ad42fbef7
SHA512

af6c0a6c582a0cfd4f7de6bf1cf0199898b31edc0dba5467a499c2148e425d91d556bd7eebd08faf093d610cbf2afbee2237affc206106c7209cb2492a563279

Score

10^/10

gozi_ifsb ursnif banker evasion persistence spyware trojan

Malware Config

Extracted

Family

ursnif

Attributes

dga_base_url
dga_crc
0
dga_season
0
dga_tlds
dns_servers

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\apssclnt\chsbmifs.dll = "0"	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\getumf32 = "rundll32 \"C:\\Users\\Admin\\AppData\\Roaming\\apssclnt\\chsbmifs.dll\",DllRegisterServer"	rundll32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1876 set thread context of 2028	1876	rundll32.exe	27
PID 2028 set thread context of 1236	2028	svchost.exe	13

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1876	rundll32.exe
1236	Explorer.EXE

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1876	rundll32.exe
2028	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1876	rundll32.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE
1236	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1236	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1876	844	rundll32.exe	26
PID 844 wrote to memory of 1876	844	rundll32.exe	26
PID 844 wrote to memory of 1876	844	rundll32.exe	26
PID 844 wrote to memory of 1876	844	rundll32.exe	26
PID 844 wrote to memory of 1876	844	rundll32.exe	26
PID 844 wrote to memory of 1876	844	rundll32.exe	26
PID 844 wrote to memory of 1876	844	rundll32.exe	26
PID 1876 wrote to memory of 2028	1876	rundll32.exe	27
PID 1876 wrote to memory of 2028	1876	rundll32.exe	27
PID 1876 wrote to memory of 2028	1876	rundll32.exe	27
PID 1876 wrote to memory of 2028	1876	rundll32.exe	27
PID 1876 wrote to memory of 2028	1876	rundll32.exe	27
PID 1876 wrote to memory of 2028	1876	rundll32.exe	27
PID 1876 wrote to memory of 2028	1876	rundll32.exe	27
PID 2028 wrote to memory of 1236	2028	svchost.exe	13
PID 2028 wrote to memory of 1236	2028	svchost.exe	13
PID 2028 wrote to memory of 1236	2028	svchost.exe	13

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1236
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5b2765aaf97ae9c22abd312e684616d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5b2765aaf97ae9c22abd312e684616d.dll,#1
    3⤵
    - Windows security modification
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1876-4-0x0000000002890000-0x000000000298C000-memory.dmp

Filesize
1008KB

Download
memory/1876-6-0x0000000000880000-0x00000000008E2000-memory.dmp

Filesize
392KB

Download
memory/2028-8-0x0000000002060000-0x000000000215C000-memory.dmp

Filesize
1008KB

Download