gozi | 277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e

General

Target

277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe
Size

366KB
MD5

cafb427e5aaf01dc82002021fa1c5211
SHA1

5936a585083d8d8955b70fdf0153071de2360af3
SHA256

277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e
SHA512

78880cca364376381a90852c2f58238f2540fcd1fd6569349ed523e25528ff15f474063fba682526ce485faa0811f766fea7877c0f87d7c18c6ada396a3074ad
SSDEEP

6144:+xyioeXqoRmL/ymMFr/fFZPU6cCl2SHZrsSNwNkYU4Br29E+pVhu:+xyHeXqUm7yxFXP3l5rs8gr2U

Score

10^/10

gozi 1012 banker isfb persistence ransomware trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1012

C2

lolila.net

vndjtu968488.ru

moriyurw368798.ru

Attributes

build
213459
exe_type
worker

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1836 cmd.exe

pid	process
1836	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\capiutil = "C:\\Windows\\system32\\drtptprf.exe"	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

Drops file in System32 directory 2 IoCs

Processes:

277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

description	ioc	process
File created	C:\Windows\system32\drtptprf.exe	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe
File opened for modification	C:\Windows\system32\drtptprf.exe	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5528.tmp"	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

description	pid	process	target process
PID 1872 set thread context of 2000	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

pid process

1872 277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2000 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

pid process

1872 277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

pid	process
1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

pid	process
1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

explorer.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: 33	1432	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1432	AUDIODG.EXE
Token: 33	1432	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1432	AUDIODG.EXE
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

explorer.exe

pid	process
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe

Suspicious use of SendNotifyMessage 17 IoCs

Processes:

explorer.exe

pid	process
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

2000 explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.execmd.exe

description	pid	process	target process
PID 1872 wrote to memory of 2000	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	explorer.exe
PID 1872 wrote to memory of 2000	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	explorer.exe
PID 1872 wrote to memory of 2000	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	explorer.exe
PID 1872 wrote to memory of 2000	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	explorer.exe
PID 1872 wrote to memory of 2000	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	explorer.exe
PID 1872 wrote to memory of 2000	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	explorer.exe
PID 1872 wrote to memory of 2000	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	explorer.exe
PID 1872 wrote to memory of 1836	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	cmd.exe
PID 1872 wrote to memory of 1836	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	cmd.exe
PID 1872 wrote to memory of 1836	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	cmd.exe
PID 1872 wrote to memory of 1836	1872	277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe	cmd.exe
PID 1836 wrote to memory of 1680	1836	cmd.exe	attrib.exe
PID 1836 wrote to memory of 1680	1836	cmd.exe	attrib.exe
PID 1836 wrote to memory of 1680	1836	cmd.exe	attrib.exe
PID 1836 wrote to memory of 1680	1836	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1680 attrib.exe

pid	process
1680	attrib.exe

C:\Users\Admin\AppData\Local\Temp\277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe
"C:\Users\Admin\AppData\Local\Temp\277aa77ab002d347d1c48c3f7287016834a7569177d266f9c5b6eaed1c4e237e.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2000

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\7CFB.bat" "C:\Users\Admin\AppData\Local\Temp\277AA7~1.EXE""
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\attrib.exe
attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\277AA7~1.EXE"
3⤵
- Views/modifies file attributes
PID:1680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x578
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1432

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7CFB.bat
Filesize
72B

MD5
94fbfa9eefddf7259c18df5ea814f331

SHA1
472879da9a1285ee1e9830f67f3e2bcf486452ad

SHA256
2c8cec5a1b1b6b3e4eb283e03aff76806e3b4ea88b973ee1e9fe6e08707118d1

SHA512
7c8aafc9ffd0b7f05a29241347da5942817544439d0e4c16899a7fd153b63f16a89fc5f5a6803eda74408baa65fbd25d0f340a342545df18c2f92f278402359e

Download Submit
memory/1680-63-0x0000000000000000-mapping.dmp

Download
memory/1836-60-0x0000000000000000-mapping.dmp

Download
memory/1872-54-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1872-56-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/1872-57-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1872-61-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2000-55-0x0000000000000000-mapping.dmp

Download
memory/2000-58-0x000007FEFB5C1000-0x000007FEFB5C3000-memory.dmp

Filesize
8KB

Download
memory/2000-59-0x00000000002D0000-0x0000000000338000-memory.dmp

Filesize
416KB

Download
memory/2000-64-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads