gozi_ifsb | 20587442b6c5c5289058461103db705d04b69ee7e5c14d6a3089348c19bc0de7

General

Target

9d3a7a1f655bdc0714e010f31ad4c6cc.ttf.dll
Size

374KB
MD5

9d3a7a1f655bdc0714e010f31ad4c6cc
SHA1

5115f00d59147a3113fab9402daeb34ffe71ae39
SHA256

20587442b6c5c5289058461103db705d04b69ee7e5c14d6a3089348c19bc0de7
SHA512

65a17e759ff8b47c01e24a0eec98c6d4bcea0001613c6214a3b1f015437f2998810aef349190fcaaf75cc692e8877c1fa3901b5d69838468c1cb416ee64c4b21

Score

10^/10

gozi_ifsb 4500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

4500

C2

authd.feronok.com

app.bighomegl.at

Attributes

build
250204
exe_type
loader
server_id
580

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24BFBD48-CAE8-11EB-A11C-D22FD1FF01E8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3296 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3296 iexplore.exe
3296 iexplore.exe
2508 IEXPLORE.EXE
2508 IEXPLORE.EXE

pid	process
3296	iexplore.exe

pid	process
3296	iexplore.exe
3296	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exeiexplore.exe

description	pid	process	target process
PID 4056 wrote to memory of 3836	4056	rundll32.exe	rundll32.exe
PID 4056 wrote to memory of 3836	4056	rundll32.exe	rundll32.exe
PID 4056 wrote to memory of 3836	4056	rundll32.exe	rundll32.exe
PID 3296 wrote to memory of 2508	3296	iexplore.exe	IEXPLORE.EXE
PID 3296 wrote to memory of 2508	3296	iexplore.exe	IEXPLORE.EXE
PID 3296 wrote to memory of 2508	3296	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d3a7a1f655bdc0714e010f31ad4c6cc.ttf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d3a7a1f655bdc0714e010f31ad4c6cc.ttf.dll,#1
2⤵
PID:3836

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3296 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-120-0x0000000000000000-mapping.dmp

Download
memory/3296-119-0x00007FF960A00000-0x00007FF960A6B000-memory.dmp

Filesize
428KB

Download
memory/3836-114-0x0000000000000000-mapping.dmp

Download
memory/3836-115-0x0000000074400000-0x000000007440D000-memory.dmp

Filesize
52KB

Download
memory/3836-116-0x0000000074400000-0x00000000744A5000-memory.dmp

Filesize
660KB

Download
memory/3836-117-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing