Analysis
-
max time kernel
144s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26-10-2022 21:59
General
-
Target
e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d.exe
-
Size
2.7MB
-
MD5
4a0ccd776503d64c271c77cc84c1645f
-
SHA1
1c017847937ffae8260728d0e0674af6b7b3c350
-
SHA256
e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d
-
SHA512
4897b866ce5e212e6a2ada94b4a5e9ac5e0129166ecda35fe106fd8000fdbff5fe87828b30b2d9b2f132e2f038bf09e3c1ca8070f1fbd0d4e115d3e5c8a0fe24
-
SSDEEP
49152:KOZyfrFDnxWwUbCkLMh5LYGwBmezZUpjjhzf29v/:dZyfrhny+h5LYGwXmpjVzf2B
Score
10/10
Malware Config
Signatures
-
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d.exe"C:\Users\Admin\AppData\Local\Temp\e9412c9aa9beed360ed8dd11568e57651db7a3ab87498932e4b7bfceb28d5b4d.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
2.8MB
-
Filesize
2.8MB