gozi_rm3 | 48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1

Analysis

max time kernel
132s
max time network
184s
platform
windows7_x64
resource
win7-20220414-en
submitted
14-07-2022 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe
Size

797KB
MD5

4f035feeae93816049e986e757f04525
SHA1

f7727fe7d403a6e18c1a21a944613c202112ff92
SHA256

48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1
SHA512

9768e4f1163e7c31325c3f4a407d74cedaa19c9796525d3b03e82e94f1f89fffb3f43b0643d6a0b850fc36a37f1a0e74d7ee8e282bd430f5485cc1689e275a03

Score

10^/10

gozi_rm3 banker persistence trojan

Malware Config

Signatures

Gozi RM3
A heavily modified version of Gozi using RM3 loader.
banker trojan gozi_rm3

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run	48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 51 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\clownfish-translator.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "26"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "110"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\clownfish-translator.com\Total = "26"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5025309a3f97d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\clownfish-translator.com\ = "26"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "58"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\clownfish-translator.com\ = "58"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\clownfish-translator.com\ = "110"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0C2A5E1-0332-11ED-B44F-5EFF8A6DE4BC} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000730126424dd2f94a9ecca9dd0898c6a900000000020000000000106600000001000020000000f2081fe03297e6486fa67b2c37b87e634a7f80d779354f8d97fad2284b1057d8000000000e8000000002000020000000a29630c81b77019ff8559bee6e5552e9f50ba36f4ae7768817a108b2d5207d44900000005c492a84c374c9975680772671ab495b007e6626c69f46a6896145e2227a746f31c50b1b8ccfb22ca25f492b161ae0ba791deca7de49d135fc125d5027e28fc267eb5e6395fc45e9766135ad9d433d3db98f34c4450dd6e17cb5febd4e866b2ca0b49ea08cab4961d045e8141cc710b905d67054826a78278a5a94cc3836afd202a9db310ddeefd95001821a7cc8442140000000bd7de9d38940a29b41df03ac7237be0f7e2d26abe8d808bd9d8f4911d683867fd3274ddf09411baacea11f2cf6c5a31cfa529c4d6bce997da4fc8dda25098420	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\clownfish-translator.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\clownfish-translator.com\Total = "58"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\clownfish-translator.com\Total = "110"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "364540176"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000730126424dd2f94a9ecca9dd0898c6a900000000020000000000106600000001000020000000105b131eec7e55b8d008a24413582a8b791ca03996a6bb30f21e10fb357104bd000000000e800000000200002000000069e3f0c6bcd79512bee2be455033e87bb21a8748e3d82eb5cfbe744b0920c0b9200000000019628d228ef4ba8752f1f6b877111adc6d41811cc1729f2a91ba904a0efcb8400000009a7ddc9be89cc9248564a79779bc1e5aa3b389af38c7470cfca5deecbb6b2d5e5805b5aae9869f01a2206d113a9ef8621213b58803747a6504cf025d77cb6e03	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
884	48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe
884	48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe
884	48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe
1440	iexplore.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
884	48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe
884	48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe
884	48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
884	48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe
1440	iexplore.exe
1440	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1440	884	48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe	29
PID 884 wrote to memory of 1440	884	48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe	29
PID 884 wrote to memory of 1440	884	48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe	29
PID 1440 wrote to memory of 1988	1440	iexplore.exe	31
PID 1440 wrote to memory of 1988	1440	iexplore.exe	31
PID 1440 wrote to memory of 1988	1440	iexplore.exe	31
PID 1440 wrote to memory of 1988	1440	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe
"C:\Users\Admin\AppData\Local\Temp\48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://clownfish-translator.com/voicechanger/#download
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1988

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:2032

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x568
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
589c442fc7a0c70dca927115a700d41e

SHA1
66a07dace3afbfd1aa07a47e6875beab62c4bb31

SHA256
2e5cb72e9eb43baafb6c6bfcc573aac92f49a8064c483f9d378a9e8e781a526a

SHA512
1b5fa79e52be495c42cf49618441fb7012e28c02e7a08a91da9213db3ab810f0e83485bc1dd5f625a47d0ba7cfcdd5ea50acc9a8dcebb39f048c40f01e94155b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
e9166e3ee31a4be8f894b6da11092e50

SHA1
743d1e3b1b7112a6ff26436bb5fca0e7a4ecd5fc

SHA256
5bba3bc0989412b9f1fbe0dc767d6ed5af1cdbccf43e734345c311f02a4bcb36

SHA512
2dda99d5aaefddcecbc253394b97a6606bbda3a02c9cd0c1c175e7528efc7ff038837d5c13a1f9ebf90ed848a257fe3470bfe79075b022aa3804f0d0f1bce080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9os4y76\imagestore.dat

Filesize
5KB

MD5
6374cc3abe1d0c44e2b098b9fdb86bf0

SHA1
5ca0d8a7502fdf8e3df3f66111aff66868d848c7

SHA256
5ded047ae35e0fb5daa4c6eef18bc67e93c956ea8ea3607e10647bf7ed7aa6f6

SHA512
dae5cc1f2b7598523f276d0f89ee518eea864c89920d5b8f28454583ca824809314bca46c462a64aa59f1df7c22c10f1b06fc150517bcf658e0d4a7240c65028

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\R32CR4WA.txt

Filesize
603B

MD5
46d7ef005792c01def74e708d41e153e

SHA1
f2807ffd8408ea23ea086de06a85145221d36c5a

SHA256
7a887ccd4f135b6e2237d57e1a3b3aba0800b9de2ce9fa30b6ac7b738361e396

SHA512
41c319895b0ec064ca504b9609194d6235e4721ce6f214d7986a88029c38383c5dc98b2653ea47901f9543a9497e6c223309dbfaa5acea2916ad0c44d324a760

Download Submit
memory/884-54-0x000007FEFBF11000-0x000007FEFBF13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads