gozi_ifsb | 2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3

Analysis

max time kernel
36s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3.exe
Size

330KB
MD5

57747bf1775275e0425ae0f364c91710
SHA1

d6f1fea65f8cdd5584bcdf3de7e1535612f69817
SHA256

2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3
SHA512

3ae9aa3d3c80ad325bf4dcbd6d6f95dc3b0a6058a00cac15a4800cea2408d5d9f702f4a3f43e730d651b2a4abd9e008eb104b836d7fc511f70e242cd0f7a0d67
SSDEEP

6144:pa6yGxGrMU+OzcapV2WvnZ4leSHhTO43NzMygTt1HW/jeLR7n+:pa9GxGwUcmUWvIHhq+MB5WKtn+

Score

10^/10

gozi_ifsb banker bootkit persistence trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1444 cmd.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1444	cmd.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3.execmd.exe

description	pid	process	target process
PID 1644 wrote to memory of 1444	1644	2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3.exe	cmd.exe
PID 1644 wrote to memory of 1444	1644	2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3.exe	cmd.exe
PID 1644 wrote to memory of 1444	1644	2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3.exe	cmd.exe
PID 1644 wrote to memory of 1444	1644	2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3.exe	cmd.exe
PID 1444 wrote to memory of 1240	1444	cmd.exe	attrib.exe
PID 1444 wrote to memory of 1240	1444	cmd.exe	attrib.exe
PID 1444 wrote to memory of 1240	1444	cmd.exe	attrib.exe
PID 1444 wrote to memory of 1240	1444	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1240 attrib.exe

pid	process
1240	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3.exe
"C:\Users\Admin\AppData\Local\Temp\2d7e27ba0ccb83128f46bcbfba5cc7673ffd8b8907b209510949d07acf1b67c3.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\3F71.bat" "C:\Users\Admin\AppData\Local\Temp\2D7E27~1.EXE""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\2D7E27~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3F71.bat

Filesize
72B

MD5
fc1ce35a41bced7dd85162fb6d0d1f49

SHA1
7cad588a9598e85d6cb4db3e54654723617d74cf

SHA256
145194077f3fb74aa0ce32f30d6ce088ea78a29c45c5a5cc3bd3c76efbd14482

SHA512
0a3425aaa0c92dee0d9fa9a3835f86020be996fcddfae70c580a3ea06149fdf950315f104bf869c6db6a66bb9d49bd0c5a4e6abf8c2c28acac5011f714591272

Download Submit
memory/1240-63-0x0000000000000000-mapping.dmp

Download
memory/1444-61-0x0000000000000000-mapping.dmp

Download
memory/1644-54-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1644-55-0x0000000000290000-0x0000000000295000-memory.dmp

Filesize
20KB

Download
memory/1644-60-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download