Analysis

  • max time kernel
    146s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    04-06-2022 00:11

General

  • Target

    11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe

  • Size

    308KB

  • MD5

    434e2060c3650402e75bfce4b8f6034e

  • SHA1

    0afdf4a1eabd95380e045111fb4f76f170e38ee4

  • SHA256

    11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845

  • SHA512

    e755ddbb3bd122fc96a6e7dd8e89d58cfceb57922bb8affff4ad7cb834b776b6e9e0cad5be7f6157231b13833f094fe7b1dfa2f1cc79d141d323b97a86e4e979

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1010

C2

sys.mohitsagarmusic.com/bcms/assets/img

sys.dylanlake653.com/bcms/assets/img

sys.cozmoattire.com/bcms/assets/img

sys.nahualbrand.com/bcms/assets/img

lansystemstat.com/bcms/assets/img

highnetwork.pw/bcms/assets/img

lostnetwork.in/bcms/assets/img

sysconnections.net/bcms/assets/img

lansupports.com/bcms/assets/img

Attributes
  • exe_type

    worker

  • server_id

    35

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
    "C:\Users\Admin\AppData\Local\Temp\11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Users\Admin\AppData\Local\Temp\11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
      "C:\Users\Admin\AppData\Local\Temp\11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe"
      2⤵
        PID:2360

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2360-132-0x0000000000000000-mapping.dmp
    • memory/2360-133-0x0000000000400000-0x0000000000439000-memory.dmp
      Filesize

      228KB

    • memory/2360-135-0x0000000000400000-0x0000000000439000-memory.dmp
      Filesize

      228KB

    • memory/2360-136-0x0000000000400000-0x0000000000439000-memory.dmp
      Filesize

      228KB

    • memory/2360-137-0x0000000000400000-0x0000000000439000-memory.dmp
      Filesize

      228KB