Analysis

  • max time kernel
    4294213s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    20/03/2022, 03:25

General

  • Target

    ef78d1bc0863a7e939b37e2daefe96450cd44e207d52e8663030fb1780eea7ba.exe

  • Size

    126KB

  • MD5

    cbbc58e6c361cadbe803e2b5db17307e

  • SHA1

    86764e2af88b290aa12669369d882a663a264c4d

  • SHA256

    ef78d1bc0863a7e939b37e2daefe96450cd44e207d52e8663030fb1780eea7ba

  • SHA512

    826d8ac99ccd75cd6fa95235ff2979e997d396e30a5ae81c9a7781a02c8560c9398bbda567edfc586d4a14244126cfde58c1f752d68b382bd5872f1337312a2a

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1051

C2

c.s-microsoft.com

ajax.googleapis.com

vlasdmkdmewnfjfnd.xyz

Attributes
  • build

    250166

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • dns_servers

    107.174.86.134

    107.175.127.22

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef78d1bc0863a7e939b37e2daefe96450cd44e207d52e8663030fb1780eea7ba.exe
    "C:\Users\Admin\AppData\Local\Temp\ef78d1bc0863a7e939b37e2daefe96450cd44e207d52e8663030fb1780eea7ba.exe"
    1⤵
      PID:1752
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1800

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1752-54-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

            Filesize

            8KB

          • memory/1752-55-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1752-56-0x00000000002A0000-0x00000000002A1000-memory.dmp

            Filesize

            4KB

          • memory/1752-57-0x00000000002E0000-0x00000000002EF000-memory.dmp

            Filesize

            60KB

          • memory/1752-58-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

            Filesize

            8KB