Overview

overview

10

Static

static

5ae7937d83...45.dll

windows7-x64

10

5ae7937d83...45.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    171s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2022, 01:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5ae7937d8333afb2bb950c8f1089e2066954a3127945f52af2e2da58b7273a45.dll
  • Size 1.1MB
  • Sample220802-b7d56sfdal
  • SHA256 5ae7937d8333afb2bb950c8f1089e2066954a3127945f52af2e2da58b7273a45
  • MD5 SHA1 SHA512
Score
10/10
gozi_ifsb1000bankerpersistencetrojan

Malware Config

Extracted

Family

  • gozi_ifsb

Botnet

  • 1000

C2

  • http://ey7kuuklgieop2pq.onion

  • http://shoshanna.at

  • http://buismashallah.at

Attributes
  • build

    217027

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 7 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3432
  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
    • Modifies registry class
    PID:4648
  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:3684
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ae7937d8333afb2bb950c8f1089e2066954a3127945f52af2e2da58b7273a45.dll,#1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ae7937d8333afb2bb950c8f1089e2066954a3127945f52af2e2da58b7273a45.dll,#1
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:464
          • C:\Windows\system32\control.exe
            C:\Windows\system32\control.exe /?
            4⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:3556
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?
              5⤵
                PID:816
        • C:\Windows\system32\cmd.exe
          cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\D2F6.bi1"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1564
          • C:\Windows\system32\nslookup.exe
            nslookup myip.opendns.com resolver1.opendns.com
            3⤵
              PID:4152
          • C:\Windows\system32\cmd.exe
            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\D2F6.bi1"
            2⤵
              PID:880
            • C:\Windows\syswow64\cmd.exe
              "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
              2⤵
                PID:4068

            Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  D2F6.bi1
                  • Path C:\Users\Admin\AppData\Local\Temp\D2F6.bi1
                  • Size 118B
                  • SHA256 58b498e17cfc59584aae9620ca60d657e3691c7bfc1896e581f3f9292390bfd8
                  • MD5 SHA1 SHA512
                  Submit Download

                  D2F6.bi1
                  • Path C:\Users\Admin\AppData\Local\Temp\D2F6.bi1
                  • Size 118B
                  • SHA256 58b498e17cfc59584aae9620ca60d657e3691c7bfc1896e581f3f9292390bfd8
                  • MD5 SHA1 SHA512
                  Submit Download

                  DdcCutil.dll
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Compound\DdcCutil.dll
                  • Size 1.1MB
                  • SHA256 5ae7937d8333afb2bb950c8f1089e2066954a3127945f52af2e2da58b7273a45
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  memory/464-138-0x0000000002BD0000-0x00000000035EB000-memory.dmp
                  Download

                  memory/464-135-0x0000000002BD1000-0x0000000002C88000-memory.dmp
                  Download

                  memory/464-137-0x0000000002BD0000-0x00000000035EB000-memory.dmp
                  Download

                  memory/464-139-0x0000000003650000-0x000000000369A000-memory.dmp
                  Download

                  memory/464-134-0x0000000002BD0000-0x0000000002C1B000-memory.dmp
                  Download

                  memory/464-147-0x0000000002BD0000-0x00000000035EB000-memory.dmp
                  Download

                  memory/464-133-0x0000000002BD0000-0x00000000035EB000-memory.dmp
                  Download

                  memory/464-131-0x0000000002BD0000-0x00000000035EB000-memory.dmp
                  Download

                  memory/816-150-0x0000015085D10000-0x0000015085DC1000-memory.dmp
                  Download

                  memory/2128-152-0x0000000002D00000-0x0000000002DB1000-memory.dmp
                  Download

                  memory/3432-153-0x000001BA53000000-0x000001BA530B1000-memory.dmp
                  Download

                  memory/3556-151-0x0000000000910000-0x00000000009C1000-memory.dmp
                  Download

                  memory/3684-154-0x000001B72CD30000-0x000001B72CDE1000-memory.dmp
                  Download

                  memory/4068-162-0x0000000000606B20-0x0000000000606B24-memory.dmp
                  Download

                  memory/4068-163-0x0000000000E70000-0x0000000000F14000-memory.dmp
                  Download

                  memory/4648-155-0x000001749FE40000-0x000001749FEF1000-memory.dmp
                  Download