Analysis

  • max time kernel
    139s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12/06/2022, 22:51

General

  • Target

    1df5bbc1cff3a247d6c3c11980b0118986e74e17e7f3836b3dea87e6f09545e9.exe

  • Size

    459KB

  • MD5

    ad75aa67ed2a0092901c74856ccf26d8

  • SHA1

    2eb24c6044442e90cf309cee62e7acc989e47405

  • SHA256

    1df5bbc1cff3a247d6c3c11980b0118986e74e17e7f3836b3dea87e6f09545e9

  • SHA512

    aa15086950eb5e4aa342a21f3e7b2d684fd151e78f99e6cda920e086591a95cbcb0f1eb1fb4600e7d6562429e120fb8376b3ed8d2b852ec77ae81d330a2563ff

Malware Config

Extracted

Family

gozi_ifsb

Attributes
  • build

    214963

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\1df5bbc1cff3a247d6c3c11980b0118986e74e17e7f3836b3dea87e6f09545e9.exe
      "C:\Users\Admin\AppData\Local\Temp\1df5bbc1cff3a247d6c3c11980b0118986e74e17e7f3836b3dea87e6f09545e9.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1732
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\A725\E57A.bat" "C:\Users\Admin\AppData\Roaming\MICROS~1\COLOorui\bidiprov.exe" "C:\Users\Admin\AppData\Local\Temp\1DF5BB~1.EXE""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C ""C:\Users\Admin\AppData\Roaming\MICROS~1\COLOorui\bidiprov.exe" "C:\Users\Admin\AppData\Local\Temp\1DF5BB~1.EXE""
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2016
          • C:\Users\Admin\AppData\Roaming\MICROS~1\COLOorui\bidiprov.exe
            "C:\Users\Admin\AppData\Roaming\MICROS~1\COLOorui\bidiprov.exe" "C:\Users\Admin\AppData\Local\Temp\1DF5BB~1.EXE"
            5⤵
            • Executes dropped EXE
            • Deletes itself
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2028
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:1956
    • C:\Windows\system32\cmd.exe
      cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\7658.bi1"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Windows\system32\nslookup.exe
        nslookup myip.opendns.com resolver1.opendns.com
        3⤵
          PID:1444
      • C:\Windows\system32\cmd.exe
        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\7658.bi1"
        2⤵
          PID:1820

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\7658.bi1

              Filesize

              118B

              MD5

              ace7e9f29953c4fbd6a930b50f792079

              SHA1

              97511e3438221ac9c30944fca7b91e87978c1248

              SHA256

              58b498e17cfc59584aae9620ca60d657e3691c7bfc1896e581f3f9292390bfd8

              SHA512

              5dc35105667f0e1231fd21b85a7dbc65f207251efbbe173545d8f0172272b0ad68cc084514f8b034b998194a4e63b29ffb862243c65bf14ab0eba3ee2d081106

            • C:\Users\Admin\AppData\Local\Temp\7658.bi1

              Filesize

              118B

              MD5

              ace7e9f29953c4fbd6a930b50f792079

              SHA1

              97511e3438221ac9c30944fca7b91e87978c1248

              SHA256

              58b498e17cfc59584aae9620ca60d657e3691c7bfc1896e581f3f9292390bfd8

              SHA512

              5dc35105667f0e1231fd21b85a7dbc65f207251efbbe173545d8f0172272b0ad68cc084514f8b034b998194a4e63b29ffb862243c65bf14ab0eba3ee2d081106

            • C:\Users\Admin\AppData\Local\Temp\A725\E57A.bat

              Filesize

              108B

              MD5

              110540422d22cddcdb1f375643345e28

              SHA1

              40ba44d9f9e35c1d25e6339df64bd543da66bfc0

              SHA256

              31767e8cb3742bf5126022eb9a713e2e91131ee909ec7713d92fb5930abac3c2

              SHA512

              6871e1ebbfed20969f6bfd73f3ba65f01843c18811399f31188010a357cb5a666696a181130b37c50821acb6ed37837cbe76dde49294c2368d7787b3eb45e036

            • C:\Users\Admin\AppData\Roaming\MICROS~1\COLOorui\bidiprov.exe

              Filesize

              459KB

              MD5

              ad75aa67ed2a0092901c74856ccf26d8

              SHA1

              2eb24c6044442e90cf309cee62e7acc989e47405

              SHA256

              1df5bbc1cff3a247d6c3c11980b0118986e74e17e7f3836b3dea87e6f09545e9

              SHA512

              aa15086950eb5e4aa342a21f3e7b2d684fd151e78f99e6cda920e086591a95cbcb0f1eb1fb4600e7d6562429e120fb8376b3ed8d2b852ec77ae81d330a2563ff

            • C:\Users\Admin\AppData\Roaming\MICROS~1\COLOorui\bidiprov.exe

              Filesize

              459KB

              MD5

              ad75aa67ed2a0092901c74856ccf26d8

              SHA1

              2eb24c6044442e90cf309cee62e7acc989e47405

              SHA256

              1df5bbc1cff3a247d6c3c11980b0118986e74e17e7f3836b3dea87e6f09545e9

              SHA512

              aa15086950eb5e4aa342a21f3e7b2d684fd151e78f99e6cda920e086591a95cbcb0f1eb1fb4600e7d6562429e120fb8376b3ed8d2b852ec77ae81d330a2563ff

            • \Users\Admin\AppData\Roaming\MICROS~1\COLOorui\bidiprov.exe

              Filesize

              459KB

              MD5

              ad75aa67ed2a0092901c74856ccf26d8

              SHA1

              2eb24c6044442e90cf309cee62e7acc989e47405

              SHA256

              1df5bbc1cff3a247d6c3c11980b0118986e74e17e7f3836b3dea87e6f09545e9

              SHA512

              aa15086950eb5e4aa342a21f3e7b2d684fd151e78f99e6cda920e086591a95cbcb0f1eb1fb4600e7d6562429e120fb8376b3ed8d2b852ec77ae81d330a2563ff

            • memory/1268-76-0x0000000004970000-0x0000000004A02000-memory.dmp

              Filesize

              584KB

            • memory/1268-70-0x0000000004970000-0x0000000004A02000-memory.dmp

              Filesize

              584KB

            • memory/1732-54-0x00000000750C1000-0x00000000750C3000-memory.dmp

              Filesize

              8KB

            • memory/1732-55-0x00000000001C0000-0x000000000021C000-memory.dmp

              Filesize

              368KB

            • memory/1732-56-0x0000000000400000-0x000000000049B000-memory.dmp

              Filesize

              620KB

            • memory/1956-68-0x00000000000D0000-0x0000000000162000-memory.dmp

              Filesize

              584KB

            • memory/1956-69-0x00000000000D0000-0x0000000000162000-memory.dmp

              Filesize

              584KB

            • memory/2028-67-0x0000000000400000-0x000000000049B000-memory.dmp

              Filesize

              620KB

            • memory/2028-65-0x0000000000400000-0x000000000049B000-memory.dmp

              Filesize

              620KB