gozi_ifsb | 934d35b702d4339f22b374ff4b7ea79daaa8546b7551e3b3bd8493bd8e084515

Analysis

max time kernel
106s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1479.lnk
Size 1KB
Sample221019-mrbkwsfhal
SHA256 95d75f9f60c28efec7ec43966a0379063aa9c7ca5351f23c77dc3e67050f559a
MD5 3a7fe4683c4e75860cda2f9cfe8286e7
SHA1 c61988e9a7270572d66305a1ae117ad88e321276
SHA512 b144c4ce2285f19e3ae7df886cee5a0d3c596c58e035b7f6d258aa0c4d223c9c02ea436326c791c9048519049c68c4f7e6e9bd1df10e997c4896c68f7ce1b4c0
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 5000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

5000

config.edge.skype.com
onlinetwork.top
linetwork.top

Attributes

base_path
/drew/
build
250246
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Executes dropped EXE 1 IoCs

pid	Process
1764	xxl.exe

Loads dropped DLL 1 IoCs

pid	Process
1924	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1924	1520	cmd.exe	29
PID 1520 wrote to memory of 1924	1520	cmd.exe	29
PID 1520 wrote to memory of 1924	1520	cmd.exe	29
PID 1924 wrote to memory of 1764	1924	cmd.exe	30
PID 1924 wrote to memory of 1764	1924	cmd.exe	30
PID 1924 wrote to memory of 1764	1924	cmd.exe	30
PID 1764 wrote to memory of 1180	1764	xxl.exe	31
PID 1764 wrote to memory of 1180	1764	xxl.exe	31
PID 1764 wrote to memory of 1180	1764	xxl.exe	31
PID 1764 wrote to memory of 1180	1764	xxl.exe	31
PID 1764 wrote to memory of 1180	1764	xxl.exe	31
PID 1764 wrote to memory of 1180	1764	xxl.exe	31
PID 1764 wrote to memory of 1180	1764	xxl.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1479.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c internee\champ.cmd dll32.exe tem dows
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Users\Admin\AppData\Local\Temp\xxl.exe
    C:\Users\Admin\AppData\Local\Temp\xxl.exe internee\boutiques.3ds,DllRegisterServer
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Users\Admin\AppData\Local\Temp\xxl.exe internee\boutiques.3ds,DllRegisterServer
      4⤵
      PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xxl.exe

Path C:\Users\Admin\AppData\Local\Temp\xxl.exe
Size 44KB
SHA256 f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9
MD5 dd81d91ff3b0763c392422865c9ac12e
SHA1 963b55acc8c566876364716d5aafa353995812a8
SHA512 8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120
SSDEEP 768:lC2UEwdMtWsxjR6l0eiJMVhbfMPURqbSEln5IyYpamDjobj8S:lkMtNoluMVdMPURqln5IUmDjoX
MD5 SHA1 SHA512 SSDEEP

Submit Download

xxl.exe

Path C:\Users\Admin\AppData\Local\Temp\xxl.exe
Size 44KB
SHA256 f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9
MD5 dd81d91ff3b0763c392422865c9ac12e
SHA1 963b55acc8c566876364716d5aafa353995812a8
SHA512 8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120
SSDEEP 768:lC2UEwdMtWsxjR6l0eiJMVhbfMPURqbSEln5IyYpamDjobj8S:lkMtNoluMVdMPURqln5IUmDjoX
MD5 SHA1 SHA512 SSDEEP

Submit Download

xxl.exe

Path \Users\Admin\AppData\Local\Temp\xxl.exe
Size 44KB
SHA256 f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9
MD5 dd81d91ff3b0763c392422865c9ac12e
SHA1 963b55acc8c566876364716d5aafa353995812a8
SHA512 8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120
SSDEEP 768:lC2UEwdMtWsxjR6l0eiJMVhbfMPURqbSEln5IyYpamDjobj8S:lkMtNoluMVdMPURqln5IUmDjoX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1180-97-0x0000000074D61000-0x0000000074D63000-memory.dmp

Download

memory/1180-98-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/1180-103-0x00000000001B0000-0x00000000001B5000-memory.dmp

Download

memory/1180-104-0x00000000001E0000-0x00000000001ED000-memory.dmp

Download

memory/1520-54-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads