gozi_ifsb | 192ae21881fe7e948c5fffc3bc1f44f904a7136d3fd251062fa304648c8a7571

General

Target

3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34.dll
Size

821KB
MD5

50a299d1e92d9205e123404c8e05904d
SHA1

c188272ab757dbbf14e74781fc90fcefe4aeb615
SHA256

3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34
SHA512

ec30f36d70ddbb6ba4aaccb3342e0a0ffbd586d2784370500a94e33aa650d1c56d3712ffc3a9e15a0558194ce26d1b76d9f2a8953220684bef634e57f4579df1

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

C2

outlook.com/login

gmail.com

worunekulo.club

horunekulo.website

Attributes

build
250196
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FCCA9597-B2B9-11EB-A11C-56A0FB8C6E6D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3260 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3260 iexplore.exe
3260 iexplore.exe
1240 IEXPLORE.EXE
1240 IEXPLORE.EXE

pid	process
3260	iexplore.exe

pid	process
3260	iexplore.exe
3260	iexplore.exe
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exeiexplore.exe

description	pid	process	target process
PID 3540 wrote to memory of 3936	3540	rundll32.exe	rundll32.exe
PID 3540 wrote to memory of 3936	3540	rundll32.exe	rundll32.exe
PID 3540 wrote to memory of 3936	3540	rundll32.exe	rundll32.exe
PID 3260 wrote to memory of 1240	3260	iexplore.exe	IEXPLORE.EXE
PID 3260 wrote to memory of 1240	3260	iexplore.exe	IEXPLORE.EXE
PID 3260 wrote to memory of 1240	3260	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b56b7298c366a323d28658a455abf0d4e78fa197a43ce13bedab05f26901d34.dll,#1
2⤵
PID:3936

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3260 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-120-0x0000000000000000-mapping.dmp

Download
memory/3260-119-0x00007FFA3F2F0000-0x00007FFA3F35B000-memory.dmp

Filesize
428KB

Download
memory/3936-114-0x0000000000000000-mapping.dmp

Download
memory/3936-115-0x0000000073FD0000-0x0000000073FDF000-memory.dmp

Filesize
60KB

Download
memory/3936-116-0x0000000073FD0000-0x00000000740BF000-memory.dmp

Filesize
956KB

Download
memory/3936-117-0x00000000032F0000-0x0000000003313000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing