Analysis

  • max time kernel
    137s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    14/06/2022, 11:20

General

  • Target

    traktor.exe

  • Size

    334.3MB

  • MD5

    a0bb2d133b174436a9d4cce527fb78d7

  • SHA1

    8e72e0115e01f32a2f72d1f31c3e641c6b66ab45

  • SHA256

    904ca32cb62dc94b61092f80fa78c5bc97d0a5394fa03438aeec85ed87ab763e

  • SHA512

    8697ef5c6d57cdc87b81216aacc2744b707c11ff3da0b914aa15805e082b03b4c0dcf5ee3f24d7cc235b26d6e1ee88dea20891aeee9d28ddf5b16424916de545

Malware Config

Extracted

Family

gozi_ifsb

Botnet

7776

C2

update.zonealarm.com

iiso.in

Attributes
  • base_path

    /drew/

  • build

    250229

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\traktor.exe
    "C:\Users\Admin\AppData\Local\Temp\traktor.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SEB6A8~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SEB6A8~1.EXE
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:548
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3604
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout 45
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\Windows\SysWOW64\timeout.exe
          timeout 45
          4⤵
          • Delays execution with timeout.exe
          PID:3136
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SEB6A8~1.EXE
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SEB6A8~1.EXE
        3⤵
        • Executes dropped EXE
        PID:4888

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SEB6A8~1.EXE

          Filesize

          333.8MB

          MD5

          63fdefb66fd14dc92a7d1f773d6f619b

          SHA1

          0a96e7edc7a7e4b805f29691a0d39e21453f9eb0

          SHA256

          360703b2b2c324dde72dcd0651251c9e882e245c22d6b7e8c3163ed34ddb62b9

          SHA512

          8665eaf4ec17bf22c219b32972d4ad3dfa05c581a04cafe727e7514d711c84e078e308d9e3b1ad5f32f7c2435873066b62b7456a05ca00778e1b50f47fd12c47

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SEB6A8~1.EXE

          Filesize

          333.8MB

          MD5

          63fdefb66fd14dc92a7d1f773d6f619b

          SHA1

          0a96e7edc7a7e4b805f29691a0d39e21453f9eb0

          SHA256

          360703b2b2c324dde72dcd0651251c9e882e245c22d6b7e8c3163ed34ddb62b9

          SHA512

          8665eaf4ec17bf22c219b32972d4ad3dfa05c581a04cafe727e7514d711c84e078e308d9e3b1ad5f32f7c2435873066b62b7456a05ca00778e1b50f47fd12c47

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SEB6A8~1.EXE

          Filesize

          333.8MB

          MD5

          63fdefb66fd14dc92a7d1f773d6f619b

          SHA1

          0a96e7edc7a7e4b805f29691a0d39e21453f9eb0

          SHA256

          360703b2b2c324dde72dcd0651251c9e882e245c22d6b7e8c3163ed34ddb62b9

          SHA512

          8665eaf4ec17bf22c219b32972d4ad3dfa05c581a04cafe727e7514d711c84e078e308d9e3b1ad5f32f7c2435873066b62b7456a05ca00778e1b50f47fd12c47

        • memory/548-133-0x00000000004E0000-0x00000000004E8000-memory.dmp

          Filesize

          32KB

        • memory/548-142-0x0000000005F90000-0x0000000006022000-memory.dmp

          Filesize

          584KB

        • memory/548-141-0x0000000006440000-0x00000000069E4000-memory.dmp

          Filesize

          5.6MB

        • memory/3604-140-0x00000000049D0000-0x00000000049EE000-memory.dmp

          Filesize

          120KB

        • memory/3604-138-0x0000000004EE0000-0x0000000004F46000-memory.dmp

          Filesize

          408KB

        • memory/3604-137-0x0000000004D40000-0x0000000004D62000-memory.dmp

          Filesize

          136KB

        • memory/3604-136-0x0000000004F70000-0x0000000005598000-memory.dmp

          Filesize

          6.2MB

        • memory/3604-135-0x0000000002300000-0x0000000002336000-memory.dmp

          Filesize

          216KB

        • memory/3604-139-0x00000000055A0000-0x0000000005606000-memory.dmp

          Filesize

          408KB

        • memory/4888-146-0x0000000000400000-0x000000000040D000-memory.dmp

          Filesize

          52KB

        • memory/4888-149-0x0000000000400000-0x000000000040D000-memory.dmp

          Filesize

          52KB

        • memory/4888-150-0x0000000000400000-0x000000000040D000-memory.dmp

          Filesize

          52KB

        • memory/4888-151-0x0000000000400000-0x000000000040D000-memory.dmp

          Filesize

          52KB

        • memory/4888-152-0x0000000000CE0000-0x0000000000CED000-memory.dmp

          Filesize

          52KB