gozi_ifsb | 2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13

General

Target

2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
Size

393KB
MD5

78711573b936a6dc94070d16d19f699c
SHA1

625af3edc53e5f0e5fcbbcb2177679dd11080c09
SHA256

2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13
SHA512

be2b7b8321dda8fe38b82f8ac944b4c95e909a176431191d47588e1d51b020dd87324de732b32522864b6955352379518b2c1ec5d85132b3bcaacd74577519db
SSDEEP

12288:CqLvHvcLEtBpTr/xK9fk/PoWRV7jCiUwgy:xL3cLEtjTrI+3oWH7Gi

Score

10^/10

gozi_ifsb 1010 banker persistence ransomware trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1010

C2

supportsstats.com/geodata/version/ip2ext

neteworkgroup.com/geodata/version/ip2ext

highnetwork.pw/geodata/version/ip2ext

lostnetwork.in/geodata/version/ip2ext

sysconnections.net/geodata/version/ip2ext

lansupports.com/geodata/version/ip2ext

Attributes

build
212578
exe_type
worker
server_id
30

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

524 cmd.exe

pid	process
524	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dpmoprov = "C:\\Windows\\system32\\cmstwave.exe"	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

Drops file in System32 directory 2 IoCs

Processes:

2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

description	ioc	process
File created	C:\Windows\system32\cmstwave.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
File opened for modification	C:\Windows\system32\cmstwave.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D11.bin"	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

description	pid	process	target process
PID 1468 set thread context of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1496 set thread context of 296	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

pid process

1496 2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

296 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

pid process

1496 2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

pid	process
1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

pid	process
1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

explorer.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	296	explorer.exe
Token: SeShutdownPrivilege	296	explorer.exe
Token: SeShutdownPrivilege	296	explorer.exe
Token: SeShutdownPrivilege	296	explorer.exe
Token: SeShutdownPrivilege	296	explorer.exe
Token: SeShutdownPrivilege	296	explorer.exe
Token: SeShutdownPrivilege	296	explorer.exe
Token: SeShutdownPrivilege	296	explorer.exe
Token: SeShutdownPrivilege	296	explorer.exe
Token: SeShutdownPrivilege	296	explorer.exe
Token: 33	1600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1600	AUDIODG.EXE
Token: 33	1600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1600	AUDIODG.EXE
Token: SeShutdownPrivilege	296	explorer.exe
Token: SeShutdownPrivilege	296	explorer.exe
Token: SeShutdownPrivilege	296	explorer.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

explorer.exe

pid	process
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe

Suspicious use of SendNotifyMessage 22 IoCs

Processes:

explorer.exe

pid	process
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe
296	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

296 explorer.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.execmd.exe

description	pid	process	target process
PID 1468 wrote to memory of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1468 wrote to memory of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1468 wrote to memory of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1468 wrote to memory of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1468 wrote to memory of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1468 wrote to memory of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1468 wrote to memory of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1468 wrote to memory of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1468 wrote to memory of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1468 wrote to memory of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1468 wrote to memory of 1496	1468	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
PID 1496 wrote to memory of 296	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	explorer.exe
PID 1496 wrote to memory of 296	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	explorer.exe
PID 1496 wrote to memory of 296	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	explorer.exe
PID 1496 wrote to memory of 296	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	explorer.exe
PID 1496 wrote to memory of 296	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	explorer.exe
PID 1496 wrote to memory of 296	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	explorer.exe
PID 1496 wrote to memory of 296	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	explorer.exe
PID 1496 wrote to memory of 524	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	cmd.exe
PID 1496 wrote to memory of 524	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	cmd.exe
PID 1496 wrote to memory of 524	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	cmd.exe
PID 1496 wrote to memory of 524	1496	2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe	cmd.exe
PID 524 wrote to memory of 1704	524	cmd.exe	attrib.exe
PID 524 wrote to memory of 1704	524	cmd.exe	attrib.exe
PID 524 wrote to memory of 1704	524	cmd.exe	attrib.exe
PID 524 wrote to memory of 1704	524	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1704 attrib.exe

pid	process
1704	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
"C:\Users\Admin\AppData\Local\Temp\2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1468

C:\Users\Admin\AppData\Local\Temp\2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe
"C:\Users\Admin\AppData\Local\Temp\2e563953d95288b1e36d9b7a556cb71d907510e40df243ec8b9c8ec1903edb13.exe"
2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\explorer.exe
C:\Windows\explorer.exe
3⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:296

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\3438.bat" "C:\Users\Admin\AppData\Local\Temp\2E5639~1.EXE""
3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\SysWOW64\attrib.exe
attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\2E5639~1.EXE"
4⤵
- Views/modifies file attributes
PID:1704

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x568
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3438.bat
Filesize
72B

MD5
6520c8f6774644ef43d42f4077a6c453

SHA1
d4b6d1f68ff0cde48c8f4151901af6b842d971aa

SHA256
f3f19349839b65de15ca2de2b692257b88127ad82afe57499b03b56defb80e19

SHA512
8c4a5d4ac124a5bba6912c267423212e5139b191f574c9167628725ab504b6fc1a51b88312e843a8f8f6fd31d563544f2e4b2e76b852cf309d8e6d3f947cc6e3

Download Submit
memory/296-68-0x0000000000000000-mapping.dmp

Download
memory/296-75-0x0000000001B60000-0x0000000001BE6000-memory.dmp

Filesize
536KB

Download
memory/296-70-0x000007FEFC5A1000-0x000007FEFC5A3000-memory.dmp

Filesize
8KB

Download
memory/524-71-0x0000000000000000-mapping.dmp

Download
memory/1496-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1496-63-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1496-64-0x000000000040110F-mapping.dmp

Download
memory/1496-66-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1496-67-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1496-61-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1496-69-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1496-54-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1496-59-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1496-72-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1496-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1496-55-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1704-74-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads