Overview

overview

10

Static

static

9

1000a36815...30.exe

windows7_x64

10

1000a36815...30.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    153s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    26-03-2022 16:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1000a3681589bed44b5776ba5e258a4becd3ec97dc00db6138d333b463501930.exe

  • Size

    461KB

  • MD5

    bdc00e7591dddffbc4cd054c3843d91d

  • SHA1

    251bbe43735b796475a0881544a7fb46a2b8f51d

  • SHA256

    1000a3681589bed44b5776ba5e258a4becd3ec97dc00db6138d333b463501930

  • SHA512

    98abac55eecefaac50977bb931d5e35fde0f2ff1ef8503e00abeeaa92d56a09bbfbd8b47bf6b2d4dbfb241b81a1451c9fe31e43da563c2c72ad092810f84f6de

Score
10/10
gozi_rm389820235bankertrojan

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300898

  • exe_type

    loader

Extracted

Family

gozi_rm3

Botnet

89820235

C2

https://exeupay.xyz

Attributes
  • build

    300898

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

    bankertrojangozi_rm3
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1000a3681589bed44b5776ba5e258a4becd3ec97dc00db6138d333b463501930.exe
    "C:\Users\Admin\AppData\Local\Temp\1000a3681589bed44b5776ba5e258a4becd3ec97dc00db6138d333b463501930.exe"
    1⤵
      PID:1320
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:2876
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3736
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3736 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4544
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3736 CREDAT:82950 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:648
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2588
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4488
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4484
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3476
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3476 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2060
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4700
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4700 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:548

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        471B

        MD5

        b180dd79252947d64b2baf43d71e4a75

        SHA1

        3905e12da4dae2b49a518286d0aeb2b2d2f62589

        SHA256

        70b91c0cdaa77e1a2c907cdf5c8786612e097d2470fbfbf6ec6674f94442a017

        SHA512

        105e7be237c4af430753b6803a89537f92191134ef4e1c11320f8aa5ef07f832750e36e8ab8cf1cd3adc6307abb900699ae439f3f549177f381e4e597cd3e544

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        434B

        MD5

        1e7e4819969abbff25d723c701d524b6

        SHA1

        8d3a4beb71175bd206b7dce89a16bf7d881f1e7e

        SHA256

        322bdb8b4909c2570b9550d458df0234410025ed60ad7b194631fda55b0e8758

        SHA512

        6206ce52de30b357d6fe1ad79dba39f328c0f7f4243d305d0c6975aaf05ddafaf5e880b18007272c41aa69d501e78f1bc20001fd7f147d7fff4dcb52a3d46500

        Download Submit

      • memory/1320-130-0x0000000000610000-0x0000000000626000-memory.dmp

        Filesize

        88KB

        Download

      • memory/1320-136-0x0000000002200000-0x0000000002228000-memory.dmp

        Filesize

        160KB

        Download

      • memory/1320-137-0x0000000000400000-0x0000000000474000-memory.dmp

        Filesize

        464KB

        Download