gozi_ifsb | 514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54

General

Target

514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54.exe
Size

497KB
MD5

607b8176885a9c8c8f2be0067ee9aeba
SHA1

7bbe505272fac18a05491b0c6f6bc92a7c26dc23
SHA256

514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54
SHA512

372eda54a5ddba51de3f091df58d00d451bb83820d79b3f97209dfbfda6991a3e3f5647b8ba0291b80b1d6322cef844ced08c7a74e0cf280b86455f00fc626a8
SSDEEP

12288:U80ftiYRgLLrxRzG6h2/8E9rK/PIEIkqv59SLes:10tjRgXG6h2D04EIkqv5UV

Score

10^/10

gozi_ifsb 1000 banker persistence trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1000

C2

rastobona.com

artefaki.com

spamhouseanilingus.ru

gazitivaton.ru

Attributes

build
200000
exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Executes dropped EXE 1 IoCs

Processes:

adslsjob.exe

pid process

1632 adslsjob.exe
Deletes itself 1 IoCs

Processes:

adslsjob.exe

pid process

1632 adslsjob.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1548 cmd.exe
1548 cmd.exe

pid	process
1632	adslsjob.exe

pid	process
1632	adslsjob.exe

pid	process
1548	cmd.exe
1548	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Devilu32 = "C:\\Users\\Admin\\AppData\\Roaming\\certcapi\\adslsjob.exe"	514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

adslsjob.exesvchost.exe

description	pid	process	target process
PID 1632 set thread context of 336	1632	adslsjob.exe	svchost.exe
PID 336 set thread context of 1416	336	svchost.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

adslsjob.exe

pid process

1632 adslsjob.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1416 Explorer.EXE
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

adslsjob.exesvchost.exe

pid process

1632 adslsjob.exe
336 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Explorer.EXE

description pid process

Token: SeShutdownPrivilege 1416 Explorer.EXE
Token: SeShutdownPrivilege 1416 Explorer.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1416 Explorer.EXE
1416 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1416 Explorer.EXE
1416 Explorer.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Explorer.EXE

pid process

1416 Explorer.EXE

pid	process
1632	adslsjob.exe

pid	process
1416	Explorer.EXE

pid	process
1632	adslsjob.exe
336	svchost.exe

description	pid	process
Token: SeShutdownPrivilege	1416	Explorer.EXE
Token: SeShutdownPrivilege	1416	Explorer.EXE

pid	process
1416	Explorer.EXE
1416	Explorer.EXE

pid	process
1416	Explorer.EXE
1416	Explorer.EXE

pid	process
1416	Explorer.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54.execmd.execmd.exeadslsjob.exesvchost.exe

description	pid	process	target process
PID 1088 wrote to memory of 1800	1088	514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54.exe	cmd.exe
PID 1088 wrote to memory of 1800	1088	514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54.exe	cmd.exe
PID 1088 wrote to memory of 1800	1088	514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54.exe	cmd.exe
PID 1088 wrote to memory of 1800	1088	514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54.exe	cmd.exe
PID 1800 wrote to memory of 1548	1800	cmd.exe	cmd.exe
PID 1800 wrote to memory of 1548	1800	cmd.exe	cmd.exe
PID 1800 wrote to memory of 1548	1800	cmd.exe	cmd.exe
PID 1800 wrote to memory of 1548	1800	cmd.exe	cmd.exe
PID 1548 wrote to memory of 1632	1548	cmd.exe	adslsjob.exe
PID 1548 wrote to memory of 1632	1548	cmd.exe	adslsjob.exe
PID 1548 wrote to memory of 1632	1548	cmd.exe	adslsjob.exe
PID 1548 wrote to memory of 1632	1548	cmd.exe	adslsjob.exe
PID 1632 wrote to memory of 336	1632	adslsjob.exe	svchost.exe
PID 1632 wrote to memory of 336	1632	adslsjob.exe	svchost.exe
PID 1632 wrote to memory of 336	1632	adslsjob.exe	svchost.exe
PID 1632 wrote to memory of 336	1632	adslsjob.exe	svchost.exe
PID 1632 wrote to memory of 336	1632	adslsjob.exe	svchost.exe
PID 1632 wrote to memory of 336	1632	adslsjob.exe	svchost.exe
PID 1632 wrote to memory of 336	1632	adslsjob.exe	svchost.exe
PID 336 wrote to memory of 1416	336	svchost.exe	Explorer.EXE
PID 336 wrote to memory of 1416	336	svchost.exe	Explorer.EXE
PID 336 wrote to memory of 1416	336	svchost.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1416
- C:\Users\Admin\AppData\Local\Temp\514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54.exe
  "C:\Users\Admin\AppData\Local\Temp\514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\B375\B375.bat" "C:\Users\Admin\AppData\Roaming\certcapi\adslsjob.exe" "C:\Users\Admin\AppData\Local\Temp\514B0D~1.EXE""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C ""C:\Users\Admin\AppData\Roaming\certcapi\adslsjob.exe" "C:\Users\Admin\AppData\Local\Temp\514B0D~1.EXE""
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1548
    - - C:\Users\Admin\AppData\Roaming\certcapi\adslsjob.exe
        
        "C:\Users\Admin\AppData\Roaming\certcapi\adslsjob.exe" "C:\Users\Admin\AppData\Local\Temp\514B0D~1.EXE"
        5⤵
        Executes dropped EXE
        Deletes itself
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1632
      - C:\Windows\system32\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B375\B375.bat

Filesize
108B

MD5
3b8b97fa38721d1f170460aafa315a8c

SHA1
44a08d069ffdf0bfd2d8e0f88995aa69cf01994a

SHA256
b69215dd7adbe4c1126f26a4789c3f42e6e16f223b49509a432b80b4c1b7e0c5

SHA512
96438c493fc994ebd13aeef642a90fe4fc4c37f4cb2c71a5f1c2b2cb763f593f5278f323cdd092cc5466a8d091917929a5eb2fb46037cf12e6bdad7ec0a1b99e

Download Submit
C:\Users\Admin\AppData\Roaming\certcapi\adslsjob.exe

Filesize
497KB

MD5
607b8176885a9c8c8f2be0067ee9aeba

SHA1
7bbe505272fac18a05491b0c6f6bc92a7c26dc23

SHA256
514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54

SHA512
372eda54a5ddba51de3f091df58d00d451bb83820d79b3f97209dfbfda6991a3e3f5647b8ba0291b80b1d6322cef844ced08c7a74e0cf280b86455f00fc626a8

Download Submit
C:\Users\Admin\AppData\Roaming\certcapi\adslsjob.exe

Filesize
497KB

MD5
607b8176885a9c8c8f2be0067ee9aeba

SHA1
7bbe505272fac18a05491b0c6f6bc92a7c26dc23

SHA256
514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54

SHA512
372eda54a5ddba51de3f091df58d00d451bb83820d79b3f97209dfbfda6991a3e3f5647b8ba0291b80b1d6322cef844ced08c7a74e0cf280b86455f00fc626a8

Download Submit
\Users\Admin\AppData\Roaming\certcapi\adslsjob.exe

Filesize
497KB

MD5
607b8176885a9c8c8f2be0067ee9aeba

SHA1
7bbe505272fac18a05491b0c6f6bc92a7c26dc23

SHA256
514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54

SHA512
372eda54a5ddba51de3f091df58d00d451bb83820d79b3f97209dfbfda6991a3e3f5647b8ba0291b80b1d6322cef844ced08c7a74e0cf280b86455f00fc626a8

Download Submit
\Users\Admin\AppData\Roaming\certcapi\adslsjob.exe

Filesize
497KB

MD5
607b8176885a9c8c8f2be0067ee9aeba

SHA1
7bbe505272fac18a05491b0c6f6bc92a7c26dc23

SHA256
514b0d82faa73cee71e7b9323411f496be435bfe01844f9369ffb2fa8cef9d54

SHA512
372eda54a5ddba51de3f091df58d00d451bb83820d79b3f97209dfbfda6991a3e3f5647b8ba0291b80b1d6322cef844ced08c7a74e0cf280b86455f00fc626a8

Download Submit
memory/336-73-0x0000000000000000-mapping.dmp

Download
memory/336-74-0x00000000005D0000-0x00000000006B9000-memory.dmp

Filesize
932KB

Download
memory/1088-58-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/1088-59-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1088-57-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1088-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1088-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1416-76-0x0000000003D80000-0x0000000003E69000-memory.dmp

Filesize
932KB

Download
memory/1416-75-0x0000000003D80000-0x0000000003E69000-memory.dmp

Filesize
932KB

Download
memory/1548-62-0x0000000000000000-mapping.dmp

Download
memory/1632-72-0x0000000000290000-0x0000000000293000-memory.dmp

Filesize
12KB

Download
memory/1632-71-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1632-69-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1632-66-0x0000000000000000-mapping.dmp

Download
memory/1800-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads