Overview

overview

10

Static

static

URLScan

urlscan

http://ntv-play.com/...

windows10_x64

10

Resubmissions

24-08-2021 14:49

210824-aq597d398e 1

16-08-2021 19:12

210816-ehaj4hbq12 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://ntv-play.com/video/04169823/tls/console-play.exe

  • Sample

    210816-ehaj4hbq12

Score
10/10
gozi_ifsb1001bankerdiscoverypersistencespywarestealersuricatatrojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1001

C2

updates.esset.com

jensjen.in

strongbilt.cc

drauduburr.ws

besstrown.cn

druckenshtalen.mn

grantedii.co

loudam62.tk

libricee.in

burbasoftw.pw

waiseen.io

trumphujtebevrot.bit

ymxslfmppjcvwkrjtfnr.co

ohnjjxasfxgxiakhtohn.in

hnhccsotdqftyicvossk.at

xcgrdxcmfirfvignnfea.ws

umvwdtbenbinronbohcc.pw
Attributes
  • dga_season

    10

  • dns_servers

    107.174.86.134

    107.175.127.22

  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Targets

    • Target

      http://ntv-play.com/video/04169823/tls/console-play.exe

    Score
    10/10
    gozi_ifsb1001bankerdiscoverypersistencespywarestealersuricatatrojan

    • Gozi, Gozi IFSB

      Gozi ISFB is a well-known and widely distributed banking trojan.

      bankertrojangozi_ifsb

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • suricata: ET MALWARE Ursnif Variant CnC Beacon

      suricata: ET MALWARE Ursnif Variant CnC Beacon

      suricata

    • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)

      suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)

      suricata

    • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

      suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

      suricata

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks