Analysis

  • max time kernel
    4294181s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    21/03/2022, 21:38

General

  • Target

    0x00080000000122ea-60.exe

  • Size

    7.7MB

  • MD5

    b61ae72b50a40197085687a8df2c4f32

  • SHA1

    ccc71c89853966f7001c6ea43287d9c396884bc6

  • SHA256

    a262c8414eafbd3587c395b4a6b08ba010efcb4681c1759396386de7d223a50b

  • SHA512

    83ce36d6bf70f2afc0bb07f403f797e2b3207501fe67a94ae69c5ae8f2530f8bd31fea6b8ad5c1f97fcff046818f2adfd1b16ed2ab89a601d15bb4162bc7c1ae

Malware Config

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x00080000000122ea-60.exe
    "C:\Users\Admin\AppData\Local\Temp\0x00080000000122ea-60.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1328
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "0x00080000000122ea-60.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:844
      • C:\Windows\system32\choice.exe
        choice /C Y /N /D Y /T 1
        3⤵
          PID:1660

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1328-54-0x000007FEFD1F0000-0x000007FEFD25C000-memory.dmp

            Filesize

            432KB

          • memory/1328-55-0x0000000000070000-0x0000000000071000-memory.dmp

            Filesize

            4KB

          • memory/1328-56-0x000007FE80010000-0x000007FE80011000-memory.dmp

            Filesize

            4KB

          • memory/1328-60-0x000000003F450000-0x000000004017A000-memory.dmp

            Filesize

            13.2MB

          • memory/1328-61-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

            Filesize

            9.9MB