gozi_rm3 | 01a3835bbcf655cd4e5331da7594f50d582a79e437cbda52c7365f76fa5987eb

General

Target

01a3835bbcf655cd4e5331da7594f50d582a79e437cbda52c7365f76fa5987eb.exe
Size

155KB
MD5

7fe0c480e6e5502dd307d4bc5a22aff3
SHA1

af19f88f91b80df3eab8359bab2323ef217685f3
SHA256

01a3835bbcf655cd4e5331da7594f50d582a79e437cbda52c7365f76fa5987eb
SHA512

a82519ffec4932fd1a79f1f51e10e3a758206ac33d4135c6731c65f0ca2b3b75818b3c6abac031f8bda94d59baf562294a3619b8d1c4a0e97806d99daff084c3

Score

10^/10

gozi_rm3 banker trojan

Malware Config

Signatures

Gozi RM3
A heavily modified version of Gozi using RM3 loader.
banker trojan gozi_rm3

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000fc15059dd8cd6cf7f37747f098934f5741648fa89653eaf22022316ae5ad7916000000000e8000000002000020000000cb526c577bb64b24f296e723ae0b2dfd3bbe7ef6021d354ec829deedf3aaddf29000000035202579d3db29dec0f8544481ecdcbdc30da6e8744321bd247cf2de7b5af5625ad9f0a4aa8da8309631ae701757574f6be66a628dfa401fd7877de2b0ee0dace6067f401c76071e3b0d02458d9cc4752b8c65e3b192c909ffb4a9d4858fdc71540c5370326556800f13e2931be4599ab828e1b375ea994dd58fa74f6b40f1f038eeba2688107e216b9caf42496606ae400000001fda6e08557b0671ee1c2d9b6ea3ebbd73142465c83c6cb3f04a27062fb909c2d86b0614a45c7bd686b2b0d9aacf84ae756a4b50e3feec58163d1db47818ffcf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000d4c6d1d1d5a32360afd758386b6223c5901264aeaafb5d0f24ada2cbbcc3de57000000000e8000000002000020000000e858e522561c507b116f1bb0475e998dbfd39f5aaa30066c43da8dd7aeb6e0db200000009cd714f6810ed94f3496c2360d4d4a421af76d5ac6769e210b2ec38a41d1bee54000000097cb3877815e62f5b251169ffe7b534b7b13c5d1e3289b7db25b1869c1201fa02dcb5490069e39e26693e746948514753fb62900c89c6199ded75851fb9bff83	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0eebea05f90d801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB283131-FC52-11EC-9794-7EE61918B1DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363784255"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1980 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

320 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

320 iexplore.exe
320 iexplore.exe
1980 IEXPLORE.EXE
1980 IEXPLORE.EXE
1980 IEXPLORE.EXE
1980 IEXPLORE.EXE

pid	process
1980	IEXPLORE.EXE

pid	process
320	iexplore.exe

pid	process
320	iexplore.exe
320	iexplore.exe
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

01a3835bbcf655cd4e5331da7594f50d582a79e437cbda52c7365f76fa5987eb.execmd.execmd.exeiexplore.exe

description	pid	process	target process
PID 1092 wrote to memory of 948	1092	01a3835bbcf655cd4e5331da7594f50d582a79e437cbda52c7365f76fa5987eb.exe	cmd.exe
PID 1092 wrote to memory of 948	1092	01a3835bbcf655cd4e5331da7594f50d582a79e437cbda52c7365f76fa5987eb.exe	cmd.exe
PID 1092 wrote to memory of 948	1092	01a3835bbcf655cd4e5331da7594f50d582a79e437cbda52c7365f76fa5987eb.exe	cmd.exe
PID 1092 wrote to memory of 948	1092	01a3835bbcf655cd4e5331da7594f50d582a79e437cbda52c7365f76fa5987eb.exe	cmd.exe
PID 948 wrote to memory of 1952	948	cmd.exe	cmd.exe
PID 948 wrote to memory of 1952	948	cmd.exe	cmd.exe
PID 948 wrote to memory of 1952	948	cmd.exe	cmd.exe
PID 1952 wrote to memory of 1144	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1144	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1144	1952	cmd.exe	reg.exe
PID 948 wrote to memory of 320	948	cmd.exe	iexplore.exe
PID 948 wrote to memory of 320	948	cmd.exe	iexplore.exe
PID 948 wrote to memory of 320	948	cmd.exe	iexplore.exe
PID 320 wrote to memory of 1980	320	iexplore.exe	IEXPLORE.EXE
PID 320 wrote to memory of 1980	320	iexplore.exe	IEXPLORE.EXE
PID 320 wrote to memory of 1980	320	iexplore.exe	IEXPLORE.EXE
PID 320 wrote to memory of 1980	320	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\01a3835bbcf655cd4e5331da7594f50d582a79e437cbda52c7365f76fa5987eb.exe
"C:\Users\Admin\AppData\Local\Temp\01a3835bbcf655cd4e5331da7594f50d582a79e437cbda52c7365f76fa5987eb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\164F.tmp\1650.tmp\1661.bat C:\Users\Admin\AppData\Local\Temp\01a3835bbcf655cd4e5331da7594f50d582a79e437cbda52c7365f76fa5987eb.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "reg query HKEY_CLASSES_ROOT\http\shell\open\command"
3⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\system32\reg.exe
reg query HKEY_CLASSES_ROOT\http\shell\open\command
4⤵
PID:1144

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.jining.gov.cn/col/col78128/index.html
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:320 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1980

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:1432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
589c442fc7a0c70dca927115a700d41e

SHA1
66a07dace3afbfd1aa07a47e6875beab62c4bb31

SHA256
2e5cb72e9eb43baafb6c6bfcc573aac92f49a8064c483f9d378a9e8e781a526a

SHA512
1b5fa79e52be495c42cf49618441fb7012e28c02e7a08a91da9213db3ab810f0e83485bc1dd5f625a47d0ba7cfcdd5ea50acc9a8dcebb39f048c40f01e94155b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
13867363cc4c75e3b7a4a6a5c8a1f81a

SHA1
ea29c8857a4f47a76b0af93757683aa19ddcfbc5

SHA256
04a0c85136ae56fe7db5c78f6edd1741c4aa77195585cb6b9d507fa3c2fc62c6

SHA512
c9ae765e1566a9531cc4178616439315831a0e80fbc19fcec7d411ac4901aa4b5ec8db9130afd27fc6dbd964aadbeb90798b7e7f48049d639e22c38b19af1f22

Download Submit
C:\Users\Admin\AppData\Local\Temp\164F.tmp\1650.tmp\1661.bat
Filesize
215B

MD5
e29ebcc9b829d97fb5c742f8275d497e

SHA1
8bd678be71499fdfb5a20e2917761e36f74d3206

SHA256
40313e3f0f92ff70966575be2f772d85a927d18ee72ea102823241a128581246

SHA512
b5617ded91d6e495466345bd19d754a18801d7f105e5c13d0b456063b4a985f8db3f45751c08012fc91bff4787c1cb401b041c0a105bbd7ca1f63f24e2cff8c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QUA4A58D.txt
Filesize
606B

MD5
a888a0a8c69a602aab9001914d833de1

SHA1
21eb988fe35bd5f4d6aa7cb31a31fb08f7f4380b

SHA256
ddb8f0c363d34acaec16acca14c573a157c06c690a6c7766ea0243544399d9f1

SHA512
15404ed823d4150b7a27d34db79c12610e740e867f58be424dc637b41df974eb59dd23e2eb392296b7380baf2271b73b31833d907233657cc313d45d7ccec227

Download Submit
memory/948-55-0x0000000000000000-mapping.dmp

Download
memory/948-59-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/1092-54-0x0000000076571000-0x0000000076573000-memory.dmp

Filesize
8KB

Download
memory/1144-58-0x0000000000000000-mapping.dmp

Download
memory/1952-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing