gozi_ifsb | c4e3fd4bec97eab33175137a64ff9f87d417b3746fbaa431a43d202e96fa6739

General

Target

dictate 06.21.doc
Size

49KB
MD5

2778650cf580fcab0d721d41ead80517
SHA1

9464966e79017b77400fd5ea0dd5f1a324cc61bd
SHA256

f2040360f616328b604f250435c203f28ed71cae425e730f1d1106dc4e00b1e1
SHA512

3f7c1d8b96e4d42213c7b9dc756a75b7a1578814933d7975192797e384b55feaeb8bb51241fbfaa25e5111b4f2c6169c056563c1272449cb7b2ed1d8c2909c8e

Score

10^/10

gozi_ifsb 6000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

6000

C2

authd.feronok.com

app.bighomegl.at

Attributes

build
250204
exe_type
loader
server_id
580

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1956	1096	explorer.exe	WINWORD.EXE

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

7 828 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1748 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

flow	pid	process
7	828	mshta.exe

pid	process
1748	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXEmshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1096 WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

pid	process
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE
1096	WINWORD.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

WINWORD.EXEexplorer.exemshta.exe

description	pid	process	target process
PID 1096 wrote to memory of 1956	1096	WINWORD.EXE	explorer.exe
PID 1096 wrote to memory of 1956	1096	WINWORD.EXE	explorer.exe
PID 1096 wrote to memory of 1956	1096	WINWORD.EXE	explorer.exe
PID 1096 wrote to memory of 1956	1096	WINWORD.EXE	explorer.exe
PID 1752 wrote to memory of 828	1752	explorer.exe	mshta.exe
PID 1752 wrote to memory of 828	1752	explorer.exe	mshta.exe
PID 1752 wrote to memory of 828	1752	explorer.exe	mshta.exe
PID 1752 wrote to memory of 828	1752	explorer.exe	mshta.exe
PID 1096 wrote to memory of 1684	1096	WINWORD.EXE	splwow64.exe
PID 1096 wrote to memory of 1684	1096	WINWORD.EXE	splwow64.exe
PID 1096 wrote to memory of 1684	1096	WINWORD.EXE	splwow64.exe
PID 1096 wrote to memory of 1684	1096	WINWORD.EXE	splwow64.exe
PID 828 wrote to memory of 1748	828	mshta.exe	regsvr32.exe
PID 828 wrote to memory of 1748	828	mshta.exe	regsvr32.exe
PID 828 wrote to memory of 1748	828	mshta.exe	regsvr32.exe
PID 828 wrote to memory of 1748	828	mshta.exe	regsvr32.exe
PID 828 wrote to memory of 1748	828	mshta.exe	regsvr32.exe
PID 828 wrote to memory of 1748	828	mshta.exe	regsvr32.exe
PID 828 wrote to memory of 1748	828	mshta.exe	regsvr32.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dictate 06.21.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\explorer.exe
explorer c:\programdata\procedureI.hta
2⤵
- Process spawned unexpected child process
PID:1956

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\procedureI.hta"
2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" c:\users\public\procedureI.jpg
3⤵
- Loads dropped DLL
PID:1748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\procedureI.hta
MD5
35d8c5ca4ad2af5f2a360cad0003bd42

SHA1
02ae1065409d7f897a90155f85881f340a847ea1

SHA256
471578f00b2f4e3aefc0dc3c625569210c67a08e6ac203de96918c31aa802bb5

SHA512
7e7f99739fa74e65ee968b432d7fa80f9cd0cd1bf45064327b88056af70ecd19ae93cf00cc51d5c317a4260931731e164dac6d3331bab263ac995cf61b031d82

Download Submit
\??\c:\users\public\procedureI.jpg
MD5
17e6579d726d5247808ebe3624794fd5

SHA1
90d9554d2532108d472f5843b4361ea3e3732744

SHA256
f13c623c28199b87407d7949e5687577cb63f00b92ddb423fd9043da8e107d99

SHA512
8139a404fcbe16b74dae50a4124545dc84c3341fcfbb8562abefb4826bf050bc700aa4ff20a36006b5f8508da130f6a2e3280cbb34bdfee1661d66a2fbc39262

Download Submit
\Users\Public\procedureI.jpg
MD5
17e6579d726d5247808ebe3624794fd5

SHA1
90d9554d2532108d472f5843b4361ea3e3732744

SHA256
f13c623c28199b87407d7949e5687577cb63f00b92ddb423fd9043da8e107d99

SHA512
8139a404fcbe16b74dae50a4124545dc84c3341fcfbb8562abefb4826bf050bc700aa4ff20a36006b5f8508da130f6a2e3280cbb34bdfee1661d66a2fbc39262

Download Submit
memory/828-67-0x0000000000000000-mapping.dmp

Download
memory/828-70-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/1096-60-0x000000006FC31000-0x000000006FC33000-memory.dmp

Filesize
8KB

Download
memory/1096-59-0x00000000721B1000-0x00000000721B4000-memory.dmp

Filesize
12KB

Download
memory/1096-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1096-78-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1684-68-0x0000000000000000-mapping.dmp

Download
memory/1748-71-0x0000000000000000-mapping.dmp

Download
memory/1748-75-0x0000000067540000-0x000000006754D000-memory.dmp

Filesize
52KB

Download
memory/1748-76-0x0000000067540000-0x000000006762A000-memory.dmp

Filesize
936KB

Download
memory/1748-77-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1752-65-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

Filesize
8KB

Download
memory/1956-62-0x0000000000000000-mapping.dmp

Download
memory/1956-64-0x000000006ABB1000-0x000000006ABB3000-memory.dmp

Filesize
8KB

Download
memory/1956-63-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads