gozi_ifsb | 4fc5fe464bee34e45e7d88c634a122164f0f2b3a78ae46a8d540eee17cf13647

Analysis

max time kernel
156s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5353.lnk
Size 1KB
Sample221020-pl6vysddep
SHA256 3217a3d5115cd2aefb82497017ed391c9400be479e56b9a6aa0e40f66da8cdcb
MD5 ab707348e10bb475ae3da7dbc3a3e791
SHA1 d201d835c1b487addfecadccf51b09c5eac35a6c
SHA512 6c9ebbb710dcbeee24432fa5f1d56c5c2473ebbc71b220780eaae825d7d3f434ad1b6d4a46ce6dafe5687155fcbf86b932852ce0f7711db85bb07128271c666a
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 5000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

5000

config.edge.skype.com
onlinetwork.top
linetwork.top

Attributes

base_path
/drew/
build
250246
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Blocklisted process makes network request 2 IoCs

flow	pid	Process
36	3556	rundll32.exe
38	3556	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
1648	xxl.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4400	4968	cmd.exe	81
PID 4968 wrote to memory of 4400	4968	cmd.exe	81
PID 4400 wrote to memory of 1648	4400	cmd.exe	82
PID 4400 wrote to memory of 1648	4400	cmd.exe	82
PID 1648 wrote to memory of 3556	1648	xxl.exe	83
PID 1648 wrote to memory of 3556	1648	xxl.exe	83
PID 1648 wrote to memory of 3556	1648	xxl.exe	83

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\5353.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c internee\highlighted.cmd dll32.exe tem dows
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Users\Admin\AppData\Local\Temp\xxl.exe
    C:\Users\Admin\AppData\Local\Temp\xxl.exe internee\reservations.3ds,DllRegisterServer
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Users\Admin\AppData\Local\Temp\xxl.exe internee\reservations.3ds,DllRegisterServer
      4⤵
      Blocklisted process makes network request
      PID:3556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xxl.exe

Path C:\Users\Admin\AppData\Local\Temp\xxl.exe
Size 70KB
SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
MD5 ef3179d498793bf4234f708d3be28633
SHA1 dd399ae46303343f9f0da189aee11c67bd868222
SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

xxl.exe

Path C:\Users\Admin\AppData\Local\Temp\xxl.exe
Size 70KB
SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
MD5 ef3179d498793bf4234f708d3be28633
SHA1 dd399ae46303343f9f0da189aee11c67bd868222
SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3556-137-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/3556-142-0x0000000002500000-0x0000000002505000-memory.dmp

Download

memory/3556-143-0x0000000002830000-0x000000000283D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads