gozi | 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f

General

Target

8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe
Size

376KB
MD5

4165eb68c959487dad6ef02646aa29c3
SHA1

fb3afa14170009086adb3a8e48ccdc189908a324
SHA256

8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f
SHA512

24942d6a4011bbea790872e56912b1855cc9e29c03bbb706ebc4c78a46d4a9bb4fa09f57683f347a273ca4e79e69b4f6c804904f4ed93fc564a860db2b07e339
SSDEEP

6144:qDf6Ygsvu1uyGSQlollY8DKc/qSUhosrLEV/V6r5:Mf6BsvmuzZGTDK2qS/yd

Score

10^/10

gozi 2782923 banker isfb persistence ransomware trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

2782923

C2

tmadecorrespondence.com

Attributes

exe_type
worker

rsa_pubkey.plain

serpent.plain

rsa_pubkey.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1612 cmd.exe

pid	process
1612	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\FwReSCOM = "C:\\Windows\\system32\\appiroxy.exe"	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

Drops file in System32 directory 2 IoCs

Processes:

8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

description	ioc	process
File created	C:\Windows\system32\appiroxy.exe	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe
File opened for modification	C:\Windows\system32\appiroxy.exe	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EB7.tmp"	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

description	pid	process	target process
PID 960 set thread context of 780	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

pid process

960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

780 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

pid process

960 8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

pid	process
960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

pid	process
960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

explorer.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: SeShutdownPrivilege	780	explorer.exe
Token: 33	1836	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1836	AUDIODG.EXE
Token: 33	1836	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1836	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

explorer.exe

pid	process
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe

Suspicious use of SendNotifyMessage 23 IoCs

Processes:

explorer.exe

pid	process
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe
780	explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.execmd.exe

description	pid	process	target process
PID 960 wrote to memory of 780	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	explorer.exe
PID 960 wrote to memory of 780	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	explorer.exe
PID 960 wrote to memory of 780	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	explorer.exe
PID 960 wrote to memory of 780	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	explorer.exe
PID 960 wrote to memory of 780	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	explorer.exe
PID 960 wrote to memory of 780	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	explorer.exe
PID 960 wrote to memory of 780	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	explorer.exe
PID 960 wrote to memory of 1612	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	cmd.exe
PID 960 wrote to memory of 1612	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	cmd.exe
PID 960 wrote to memory of 1612	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	cmd.exe
PID 960 wrote to memory of 1612	960	8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe	cmd.exe
PID 1612 wrote to memory of 844	1612	cmd.exe	attrib.exe
PID 1612 wrote to memory of 844	1612	cmd.exe	attrib.exe
PID 1612 wrote to memory of 844	1612	cmd.exe	attrib.exe
PID 1612 wrote to memory of 844	1612	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

844 attrib.exe

pid	process
844	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe
"C:\Users\Admin\AppData\Local\Temp\8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:780

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\7182520.bat" "C:\Users\Admin\AppData\Local\Temp\8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe""
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\attrib.exe
attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\8cd8efad8c6d62328a95a2be9b7bf3977ffcc066dc8f82010bdd56a6d0d6d11f.exe"
3⤵
- Views/modifies file attributes
PID:844

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7182520.bat
Filesize
72B

MD5
bd37b79d860b562df144427ffbc232af

SHA1
529e9d1f12e886d8d8007660221ca7de4f9de512

SHA256
f34dc2f040c2f5a320f1955fd77e4fa89bd50d48c28723b06f0c8fbcc9ef35f5

SHA512
4c273e028f983f8640b1dbf45ac665afe1d5c8aa82752f9be60895ae44c79b9dc14f780f2fbedb7895a8e977670dd098d398614486b31776cb02c452f11e3270

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB7.tmp
Filesize
3.5MB

MD5
23e6b8b28e19060d30cd841ce1f02d93

SHA1
e5babef1a84f75dae910bcf9a34badfd96ca56e1

SHA256
4a1fdc9e4df5c4d39b2259154f0118b0bb6a59e2507dbfa10519d3c164f8efea

SHA512
ce29115d0ca1d6855e2579a0ae9d4def3f0f99dcb4fc2a727e171c4730cfa437e7dc4d2b9a2a810369811c44fba584beabb33b45e2e99a56f7b0a76c59c285a1

Download Submit
memory/780-57-0x0000000000000000-mapping.dmp

Download
memory/780-58-0x0000000000200000-0x000000000025C000-memory.dmp

Filesize
368KB

Download
memory/780-59-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Filesize
8KB

Download
memory/780-60-0x0000000000200000-0x000000000025C000-memory.dmp

Filesize
368KB

Download
memory/844-64-0x0000000000000000-mapping.dmp

Download
memory/960-54-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/960-55-0x0000000002370000-0x00000000024F3000-memory.dmp

Filesize
1.5MB

Download
memory/960-56-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1612-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads