gozi | e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a

General

Target

e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe
Size

251KB
MD5

5a2464dd8d358eae6a7c4e3f34e2c397
SHA1

05bba1190ef667f51057f90b957ee1563bf1c0ee
SHA256

e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a
SHA512

93b528c9467413de1be7c798258aae93b1880ca2c2ea39d05594017b97e383edac7ff069a2f13d6b447658758a9c26632578e07a3289a5af68a06ec96168dc6e
SSDEEP

6144:4m6TcxBf15vI3hGYFaOH7j7eF3uREWRKRU1z:44xpQwYFa0H7exiNR1z

Score

10^/10

gozi 1000 banker isfb persistence trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1000

C2

178.33.145.49/adwordsdata/dropbox/xxx

Attributes

exe_type
worker

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1900 cmd.exe

pid	process
1900	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmstLSys = "C:\\Windows\\system32\\crtdript.exe"	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe

Drops file in System32 directory 2 IoCs

Processes:

e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe

description	ioc	process
File created	C:\Windows\system32\crtdript.exe	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe
File opened for modification	C:\Windows\system32\crtdript.exe	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe

description	pid	process	target process
PID 1496 set thread context of 268	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe

pid process

1496 e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

268 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe

pid process

1496 e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe

pid	process
1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe

pid	process
1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

explorer.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe
Token: 33	1948	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1948	AUDIODG.EXE
Token: 33	1948	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1948	AUDIODG.EXE
Token: SeShutdownPrivilege	268	explorer.exe
Token: SeShutdownPrivilege	268	explorer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

explorer.exe

pid	process
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

explorer.exe

pid	process
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe
268	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

268 explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.execmd.exe

description	pid	process	target process
PID 1496 wrote to memory of 268	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	explorer.exe
PID 1496 wrote to memory of 268	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	explorer.exe
PID 1496 wrote to memory of 268	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	explorer.exe
PID 1496 wrote to memory of 268	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	explorer.exe
PID 1496 wrote to memory of 268	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	explorer.exe
PID 1496 wrote to memory of 268	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	explorer.exe
PID 1496 wrote to memory of 268	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	explorer.exe
PID 1496 wrote to memory of 1900	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	cmd.exe
PID 1496 wrote to memory of 1900	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	cmd.exe
PID 1496 wrote to memory of 1900	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	cmd.exe
PID 1496 wrote to memory of 1900	1496	e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe	cmd.exe
PID 1900 wrote to memory of 1112	1900	cmd.exe	attrib.exe
PID 1900 wrote to memory of 1112	1900	cmd.exe	attrib.exe
PID 1900 wrote to memory of 1112	1900	cmd.exe	attrib.exe
PID 1900 wrote to memory of 1112	1900	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1112 attrib.exe

pid	process
1112	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe
"C:\Users\Admin\AppData\Local\Temp\e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:268

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\7259069.bat" "C:\Users\Admin\AppData\Local\Temp\e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe""
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\attrib.exe
attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\e351ae6323af450d16c9627ef112df268635fe9a16d20fd7e14c9e9e36ed0a3a.exe"
3⤵
- Views/modifies file attributes
PID:1112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x590
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7259069.bat
Filesize
72B

MD5
2c2493054901b32b0b03c5ea36b597ed

SHA1
69e949d5bbf7717201a68121ace99b00f87c61a8

SHA256
61fc412b8374cee11b383fd6e045c7b958d09c82fc9f717663002145ffb9dc45

SHA512
3bdf9b76137e316cf59f37f7b6643a1d0051c05b0eb226b21ddbdf3612265adb1ca418044b4950a35f6a104c181dec04bc2cadecd041f12779e30dc7bf3dd9ab

Download Submit
memory/268-57-0x0000000000000000-mapping.dmp

Download
memory/268-59-0x00000000001E0000-0x0000000000249000-memory.dmp

Filesize
420KB

Download
memory/268-61-0x000007FEFB8D1000-0x000007FEFB8D3000-memory.dmp

Filesize
8KB

Download
memory/268-65-0x00000000001E0000-0x0000000000249000-memory.dmp

Filesize
420KB

Download
memory/1112-64-0x0000000000000000-mapping.dmp

Download
memory/1496-54-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1496-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1496-56-0x0000000000400000-0x0000000000BC5000-memory.dmp

Filesize
7.8MB

Download
memory/1496-58-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1496-60-0x0000000000400000-0x0000000000BC5000-memory.dmp

Filesize
7.8MB

Download
memory/1900-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads