gozi | 243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92

General

Target

243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe
Size

400KB
MD5

f2c99d1468069fee1417e16f09bba493
SHA1

d2e4cea9cf77cfddfad8f4eb572d1c8e64c64256
SHA256

243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92
SHA512

8a27e5ff21e73934269381b1359ebc49725519ae9cbdf36ab4c5bba27860fbb6132748d496979373877599bb9bb98f68cd7782b2438c10e46404fdcd7d56177b
SSDEEP

6144:aeKC53Hp0o69kRx7B3eAziFDVvXiSp2xdrlYYZRMFf:pKCl969k77Bxi/crhZRM5

Score

10^/10

gozi 1012 banker isfb persistence ransomware trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1012

C2

lolila.net

vndjtu968488.ru

moriyurw368798.ru

Attributes

build
213425
exe_type
worker

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2032 cmd.exe

pid	process
2032	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\capiutil = "C:\\Windows\\system32\\drtptprf.exe"	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

Drops file in System32 directory 2 IoCs

Processes:

243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

description	ioc	process
File created	C:\Windows\system32\drtptprf.exe	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe
File opened for modification	C:\Windows\system32\drtptprf.exe	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DE45.tmp"	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

description	pid	process	target process
PID 904 set thread context of 1464	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

pid process

904 243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1464 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

pid process

904 243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

pid	process
904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

pid	process
904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

explorer.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	1464	explorer.exe
Token: SeShutdownPrivilege	1464	explorer.exe
Token: SeShutdownPrivilege	1464	explorer.exe
Token: SeShutdownPrivilege	1464	explorer.exe
Token: SeShutdownPrivilege	1464	explorer.exe
Token: SeShutdownPrivilege	1464	explorer.exe
Token: SeShutdownPrivilege	1464	explorer.exe
Token: SeShutdownPrivilege	1464	explorer.exe
Token: SeShutdownPrivilege	1464	explorer.exe
Token: SeShutdownPrivilege	1464	explorer.exe
Token: 33	1196	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1196	AUDIODG.EXE
Token: 33	1196	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1196	AUDIODG.EXE
Token: SeShutdownPrivilege	1464	explorer.exe
Token: SeShutdownPrivilege	1464	explorer.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

explorer.exe

pid	process
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe

Suspicious use of SendNotifyMessage 19 IoCs

Processes:

explorer.exe

pid	process
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

1464 explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.execmd.exe

description	pid	process	target process
PID 904 wrote to memory of 1464	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	explorer.exe
PID 904 wrote to memory of 1464	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	explorer.exe
PID 904 wrote to memory of 1464	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	explorer.exe
PID 904 wrote to memory of 1464	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	explorer.exe
PID 904 wrote to memory of 1464	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	explorer.exe
PID 904 wrote to memory of 1464	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	explorer.exe
PID 904 wrote to memory of 1464	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	explorer.exe
PID 904 wrote to memory of 2032	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	cmd.exe
PID 904 wrote to memory of 2032	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	cmd.exe
PID 904 wrote to memory of 2032	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	cmd.exe
PID 904 wrote to memory of 2032	904	243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe	cmd.exe
PID 2032 wrote to memory of 2024	2032	cmd.exe	attrib.exe
PID 2032 wrote to memory of 2024	2032	cmd.exe	attrib.exe
PID 2032 wrote to memory of 2024	2032	cmd.exe	attrib.exe
PID 2032 wrote to memory of 2024	2032	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

2024 attrib.exe

pid	process
2024	attrib.exe

C:\Users\Admin\AppData\Local\Temp\243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe
"C:\Users\Admin\AppData\Local\Temp\243468fa4552f6fbdf4add8ad8297335d45b5aa828464377b3c3ca82ab0d9e92.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1464

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\5A10.bat" "C:\Users\Admin\AppData\Local\Temp\243468~1.EXE""
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\attrib.exe
attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\243468~1.EXE"
3⤵
- Views/modifies file attributes
PID:2024

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5A10.bat
Filesize
72B

MD5
cceb138b2f3dcf103a26edb15afdfbda

SHA1
10948a0bfaa9cc70eab20b482b101e10db175290

SHA256
17fa336fbea4321ae87e68555dfd6a6381e1c83eb1b729002582d99b6a2d5830

SHA512
9d45e685eaba83a7da4800f827adff5c1224ea16cb4c2b2629a5e359eaab196c351858db756d5a3e754347e61d4277def4938c64fea130724ed95a444ab29aea

Download Submit
memory/904-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/904-56-0x0000000000250000-0x000000000028A000-memory.dmp

Filesize
232KB

Download
memory/904-58-0x0000000000400000-0x0000000003929000-memory.dmp

Filesize
53.2MB

Download
memory/904-63-0x0000000000400000-0x0000000003929000-memory.dmp

Filesize
53.2MB

Download
memory/1464-55-0x0000000000000000-mapping.dmp

Download
memory/1464-57-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp

Filesize
8KB

Download
memory/1464-59-0x00000000002E0000-0x0000000000348000-memory.dmp

Filesize
416KB

Download
memory/2024-62-0x0000000000000000-mapping.dmp

Download
memory/2032-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads