gozi_ifsb | 1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a

General

Target

1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a.exe
Size

388KB
MD5

0bb4c690fe90c499275a1b268b5ff0eb
SHA1

4308d202a1f308db17e6a5b1eda83aa18aa45ece
SHA256

1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a
SHA512

9b01f020cc2899eb10353072359d343e6b81df1fbea6f6f2d5b138c039a1d9b160da814aaf194fae9561c35550724b1623b086282846d31da9b8dfb89fe83074

Score

10^/10

gozi_ifsb 1010 banker persistence trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1010

C2

diuolirt.at

deopliazae.at

nifredao.com

filokiyurt.at

Attributes

exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Executes dropped EXE 1 IoCs

Processes:

ACCTient.exe

pid process

2000 ACCTient.exe
Deletes itself 1 IoCs

Processes:

ACCTient.exe

pid process

2000 ACCTient.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1980 cmd.exe
1980 cmd.exe

pid	process
2000	ACCTient.exe

pid	process
2000	ACCTient.exe

pid	process
1980	cmd.exe
1980	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audiedit = "C:\\Users\\Admin\\AppData\\Roaming\\bitsmuid\\ACCTient.exe"	1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

ACCTient.exesvchost.exe

description	pid	process	target process
PID 2000 set thread context of 1948	2000	ACCTient.exe	svchost.exe
PID 1948 set thread context of 1396	1948	svchost.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ACCTient.exeExplorer.EXE

pid process

2000 ACCTient.exe
1396 Explorer.EXE
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

ACCTient.exesvchost.exe

pid process

2000 ACCTient.exe
1948 svchost.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1396 Explorer.EXE
1396 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1396 Explorer.EXE
1396 Explorer.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Explorer.EXE

pid process

1396 Explorer.EXE

pid	process
2000	ACCTient.exe
1396	Explorer.EXE

pid	process
2000	ACCTient.exe
1948	svchost.exe

pid	process
1396	Explorer.EXE
1396	Explorer.EXE

pid	process
1396	Explorer.EXE
1396	Explorer.EXE

pid	process
1396	Explorer.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a.execmd.execmd.exeACCTient.exesvchost.exe

description	pid	process	target process
PID 784 wrote to memory of 2016	784	1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a.exe	cmd.exe
PID 784 wrote to memory of 2016	784	1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a.exe	cmd.exe
PID 784 wrote to memory of 2016	784	1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a.exe	cmd.exe
PID 784 wrote to memory of 2016	784	1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a.exe	cmd.exe
PID 2016 wrote to memory of 1980	2016	cmd.exe	cmd.exe
PID 2016 wrote to memory of 1980	2016	cmd.exe	cmd.exe
PID 2016 wrote to memory of 1980	2016	cmd.exe	cmd.exe
PID 2016 wrote to memory of 1980	2016	cmd.exe	cmd.exe
PID 1980 wrote to memory of 2000	1980	cmd.exe	ACCTient.exe
PID 1980 wrote to memory of 2000	1980	cmd.exe	ACCTient.exe
PID 1980 wrote to memory of 2000	1980	cmd.exe	ACCTient.exe
PID 1980 wrote to memory of 2000	1980	cmd.exe	ACCTient.exe
PID 2000 wrote to memory of 1948	2000	ACCTient.exe	svchost.exe
PID 2000 wrote to memory of 1948	2000	ACCTient.exe	svchost.exe
PID 2000 wrote to memory of 1948	2000	ACCTient.exe	svchost.exe
PID 2000 wrote to memory of 1948	2000	ACCTient.exe	svchost.exe
PID 2000 wrote to memory of 1948	2000	ACCTient.exe	svchost.exe
PID 2000 wrote to memory of 1948	2000	ACCTient.exe	svchost.exe
PID 2000 wrote to memory of 1948	2000	ACCTient.exe	svchost.exe
PID 1948 wrote to memory of 1396	1948	svchost.exe	Explorer.EXE
PID 1948 wrote to memory of 1396	1948	svchost.exe	Explorer.EXE
PID 1948 wrote to memory of 1396	1948	svchost.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Users\Admin\AppData\Local\Temp\1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a.exe
"C:\Users\Admin\AppData\Local\Temp\1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\8C2C\23.bat" "C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\1D63B5~1.EXE""
3⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\cmd.exe
cmd /C ""C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\1D63B5~1.EXE""
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980

C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
"C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\1D63B5~1.EXE"
5⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8C2C\23.bat
Filesize
108B

MD5
4c1a57592f597a511e6f1fdc7c136e10

SHA1
c943ddbaf4fb32215855144c1939ac796a2e08fb

SHA256
cea9a1bd0293bb12da36d85d405fa767aa47542822ddd681b92339a0c401550e

SHA512
3e74d762d062a4032281a31efecb2ca2bb92c0f95884925e9981ef93f01197111fe6cb8346354de1c48e7f194f0be693a9ba81dea916f12d8bf3cff24970bb3b

Download Submit
C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
Filesize
388KB

MD5
0bb4c690fe90c499275a1b268b5ff0eb

SHA1
4308d202a1f308db17e6a5b1eda83aa18aa45ece

SHA256
1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a

SHA512
9b01f020cc2899eb10353072359d343e6b81df1fbea6f6f2d5b138c039a1d9b160da814aaf194fae9561c35550724b1623b086282846d31da9b8dfb89fe83074

Download Submit
C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
Filesize
388KB

MD5
0bb4c690fe90c499275a1b268b5ff0eb

SHA1
4308d202a1f308db17e6a5b1eda83aa18aa45ece

SHA256
1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a

SHA512
9b01f020cc2899eb10353072359d343e6b81df1fbea6f6f2d5b138c039a1d9b160da814aaf194fae9561c35550724b1623b086282846d31da9b8dfb89fe83074

Download Submit
\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
Filesize
388KB

MD5
0bb4c690fe90c499275a1b268b5ff0eb

SHA1
4308d202a1f308db17e6a5b1eda83aa18aa45ece

SHA256
1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a

SHA512
9b01f020cc2899eb10353072359d343e6b81df1fbea6f6f2d5b138c039a1d9b160da814aaf194fae9561c35550724b1623b086282846d31da9b8dfb89fe83074

Download Submit
\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
Filesize
388KB

MD5
0bb4c690fe90c499275a1b268b5ff0eb

SHA1
4308d202a1f308db17e6a5b1eda83aa18aa45ece

SHA256
1d63b5ce77d19d8522c2fec8776170851701ac3e983687dc61f94324307fa67a

SHA512
9b01f020cc2899eb10353072359d343e6b81df1fbea6f6f2d5b138c039a1d9b160da814aaf194fae9561c35550724b1623b086282846d31da9b8dfb89fe83074

Download Submit
memory/784-55-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/784-57-0x0000000000220000-0x0000000000250000-memory.dmp

Filesize
192KB

Download
memory/784-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1396-72-0x0000000002990000-0x0000000002A05000-memory.dmp

Filesize
468KB

Download
memory/1396-73-0x0000000002990000-0x0000000002A05000-memory.dmp

Filesize
468KB

Download
memory/1948-70-0x0000000000000000-mapping.dmp

Download
memory/1948-71-0x0000000000430000-0x00000000004A5000-memory.dmp

Filesize
468KB

Download
memory/1980-60-0x0000000000000000-mapping.dmp

Download
memory/2000-64-0x0000000000000000-mapping.dmp

Download
memory/2000-67-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2000-69-0x00000000003A0000-0x00000000003D0000-memory.dmp

Filesize
192KB

Download
memory/2016-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads