Analysis

  • max time kernel
    60s
  • max time network
    105s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12/06/2022, 21:28

General

  • Target

    1e53c04cd46f339b05a6997303f5befc4efc0de76875abe0180fc27d7fe7322d.exe

  • Size

    482KB

  • MD5

    f7f9c6d6ca43fe06303cc2dbd0456742

  • SHA1

    2d505875b4e120306259a11dc9f7e4f24030dbc2

  • SHA256

    1e53c04cd46f339b05a6997303f5befc4efc0de76875abe0180fc27d7fe7322d

  • SHA512

    74bafab7303ee85c1e76d82ee27e86ad6df6bbbbca56ffd6f868260c3fc40feeb7152641e12b0c4841633601b818109c7a4c6792570998404dbc8c50255712d1

Malware Config

Extracted

Family

gozi_ifsb

Attributes
  • build

    214963

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Users\Admin\AppData\Local\Temp\1e53c04cd46f339b05a6997303f5befc4efc0de76875abe0180fc27d7fe7322d.exe
      "C:\Users\Admin\AppData\Local\Temp\1e53c04cd46f339b05a6997303f5befc4efc0de76875abe0180fc27d7fe7322d.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\A9C7\31.bat" "C:\Users\Admin\AppData\Roaming\MICROS~1\Authput8\bridkmon.exe" "C:\Users\Admin\AppData\Local\Temp\1E53C0~1.EXE""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1912
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C ""C:\Users\Admin\AppData\Roaming\MICROS~1\Authput8\bridkmon.exe" "C:\Users\Admin\AppData\Local\Temp\1E53C0~1.EXE""
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1916
          • C:\Users\Admin\AppData\Roaming\MICROS~1\Authput8\bridkmon.exe
            "C:\Users\Admin\AppData\Roaming\MICROS~1\Authput8\bridkmon.exe" "C:\Users\Admin\AppData\Local\Temp\1E53C0~1.EXE"
            5⤵
            • Executes dropped EXE
            • Deletes itself
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1136
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:1176
    • C:\Windows\system32\cmd.exe
      cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\4238.bi1"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Windows\system32\nslookup.exe
        nslookup myip.opendns.com resolver1.opendns.com
        3⤵
          PID:1432
      • C:\Windows\system32\cmd.exe
        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4238.bi1"
        2⤵
          PID:2012

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\4238.bi1

              Filesize

              118B

              MD5

              41a49d1a2a3a8713a12ccf89932d4bb7

              SHA1

              b324e8bbcd4ca71a35d0c00ac63c0255e8ec4287

              SHA256

              f210a8e30967b13dabe340c45ce4a97e9c94ad74975728eccdd0a27edf29b5fe

              SHA512

              1fc256f2068eb9ac32c04bad119e94ba006808fd2be48db397eecf69acd6d8972334f81f8439d6e153a9cb99db618a613f3b0adf2b5784c264b61d4d5c0669b1

            • C:\Users\Admin\AppData\Local\Temp\4238.bi1

              Filesize

              118B

              MD5

              41a49d1a2a3a8713a12ccf89932d4bb7

              SHA1

              b324e8bbcd4ca71a35d0c00ac63c0255e8ec4287

              SHA256

              f210a8e30967b13dabe340c45ce4a97e9c94ad74975728eccdd0a27edf29b5fe

              SHA512

              1fc256f2068eb9ac32c04bad119e94ba006808fd2be48db397eecf69acd6d8972334f81f8439d6e153a9cb99db618a613f3b0adf2b5784c264b61d4d5c0669b1

            • C:\Users\Admin\AppData\Local\Temp\A9C7\31.bat

              Filesize

              108B

              MD5

              a2cdddf0459419c710893342557b2775

              SHA1

              eb554d1a1eae3e2e7ac32cb66fced75cf956acda

              SHA256

              279230c2875214f4ad47a51c9e3eeb45d68241e0a68e172382782ab887d9dcde

              SHA512

              18215821f37297376f2e9208ffc63afe4bcb1c91a46c94d955a2b6576722aa040a7a168fc31d4d2e0484b9103c3fcde388ce8295c8ad13c028f11c890da9cad6

            • C:\Users\Admin\AppData\Roaming\MICROS~1\Authput8\bridkmon.exe

              Filesize

              482KB

              MD5

              f7f9c6d6ca43fe06303cc2dbd0456742

              SHA1

              2d505875b4e120306259a11dc9f7e4f24030dbc2

              SHA256

              1e53c04cd46f339b05a6997303f5befc4efc0de76875abe0180fc27d7fe7322d

              SHA512

              74bafab7303ee85c1e76d82ee27e86ad6df6bbbbca56ffd6f868260c3fc40feeb7152641e12b0c4841633601b818109c7a4c6792570998404dbc8c50255712d1

            • C:\Users\Admin\AppData\Roaming\MICROS~1\Authput8\bridkmon.exe

              Filesize

              482KB

              MD5

              f7f9c6d6ca43fe06303cc2dbd0456742

              SHA1

              2d505875b4e120306259a11dc9f7e4f24030dbc2

              SHA256

              1e53c04cd46f339b05a6997303f5befc4efc0de76875abe0180fc27d7fe7322d

              SHA512

              74bafab7303ee85c1e76d82ee27e86ad6df6bbbbca56ffd6f868260c3fc40feeb7152641e12b0c4841633601b818109c7a4c6792570998404dbc8c50255712d1

            • \Users\Admin\AppData\Roaming\MICROS~1\Authput8\bridkmon.exe

              Filesize

              482KB

              MD5

              f7f9c6d6ca43fe06303cc2dbd0456742

              SHA1

              2d505875b4e120306259a11dc9f7e4f24030dbc2

              SHA256

              1e53c04cd46f339b05a6997303f5befc4efc0de76875abe0180fc27d7fe7322d

              SHA512

              74bafab7303ee85c1e76d82ee27e86ad6df6bbbbca56ffd6f868260c3fc40feeb7152641e12b0c4841633601b818109c7a4c6792570998404dbc8c50255712d1

            • memory/1120-58-0x0000000000400000-0x00000000004A1000-memory.dmp

              Filesize

              644KB

            • memory/1120-55-0x0000000000380000-0x00000000003DC000-memory.dmp

              Filesize

              368KB

            • memory/1120-56-0x0000000000400000-0x00000000004A1000-memory.dmp

              Filesize

              644KB

            • memory/1120-54-0x00000000759E1000-0x00000000759E3000-memory.dmp

              Filesize

              8KB

            • memory/1136-68-0x0000000000400000-0x00000000004A1000-memory.dmp

              Filesize

              644KB

            • memory/1136-67-0x0000000000400000-0x00000000004A1000-memory.dmp

              Filesize

              644KB

            • memory/1176-69-0x00000000001C0000-0x0000000000252000-memory.dmp

              Filesize

              584KB

            • memory/1396-70-0x0000000003C00000-0x0000000003C92000-memory.dmp

              Filesize

              584KB

            • memory/1396-76-0x0000000003C00000-0x0000000003C92000-memory.dmp

              Filesize

              584KB