gozi | 500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781

General

Target

500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe
Size

243KB
MD5

c2db310b19a07816183638816938eb5d
SHA1

ea5d7cfd5d278f019a77b99cfac9a8e0709d591e
SHA256

500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781
SHA512

54cd7c8c5b100e222dd53f338f6f4b8d2fb1fc55db36e848288881b1b5e4ad8200b0cc45d2d36f54bff9faff55e4d49a54a17b866687d2905789a20375eaf772
SSDEEP

6144:x4y6j8ncpnrKlEtSfTKfRn/kXfMbpuUW:uVAcpnulEEfWfR/YMbp

Score

10^/10

gozi 1000 banker isfb persistence trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1000

C2

goliathuz.com

musicvideoporntip3s.ru

Attributes

exe_type
worker

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

pid	Process
2012	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\capiutil = "C:\\Windows\\system32\\drtptprf.exe"	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drtptprf.exe	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe
File opened for modification	C:\Windows\system32\drtptprf.exe	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 2020 set thread context of 1240	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	29

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1240	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1240	explorer.exe
Token: SeShutdownPrivilege	1240	explorer.exe
Token: SeShutdownPrivilege	1240	explorer.exe
Token: SeShutdownPrivilege	1240	explorer.exe
Token: SeShutdownPrivilege	1240	explorer.exe
Token: SeShutdownPrivilege	1240	explorer.exe
Token: SeShutdownPrivilege	1240	explorer.exe
Token: SeShutdownPrivilege	1240	explorer.exe
Token: SeShutdownPrivilege	1240	explorer.exe
Token: SeShutdownPrivilege	1240	explorer.exe
Token: 33	1600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1600	AUDIODG.EXE
Token: 33	1600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1600	AUDIODG.EXE
Token: SeShutdownPrivilege	1240	explorer.exe
Token: SeShutdownPrivilege	1240	explorer.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe
1240	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1240	explorer.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 1440 wrote to memory of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 1440 wrote to memory of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 1440 wrote to memory of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 1440 wrote to memory of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 1440 wrote to memory of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 1440 wrote to memory of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 1440 wrote to memory of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 1440 wrote to memory of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 1440 wrote to memory of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 1440 wrote to memory of 2020	1440	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	28
PID 2020 wrote to memory of 1240	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	29
PID 2020 wrote to memory of 1240	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	29
PID 2020 wrote to memory of 1240	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	29
PID 2020 wrote to memory of 1240	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	29
PID 2020 wrote to memory of 1240	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	29
PID 2020 wrote to memory of 1240	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	29
PID 2020 wrote to memory of 1240	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	29
PID 2020 wrote to memory of 2012	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	30
PID 2020 wrote to memory of 2012	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	30
PID 2020 wrote to memory of 2012	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	30
PID 2020 wrote to memory of 2012	2020	500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe	30
PID 2012 wrote to memory of 904	2012	cmd.exe	32
PID 2012 wrote to memory of 904	2012	cmd.exe	32
PID 2012 wrote to memory of 904	2012	cmd.exe	32
PID 2012 wrote to memory of 904	2012	cmd.exe	32

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
904	attrib.exe

C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe
"C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe
  "C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1240
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\7078326.bat" "C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe""
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe"
      4⤵
      Views/modifies file attributes
      PID:904

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x58c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7078326.bat

Filesize
72B

MD5
937e8ff52dcfbb5962ff34719fd9cf4c

SHA1
f3d936b994f86f50c761694a1186f06271cd24c8

SHA256
d237205ff1bf403ab6fc820f4d633734256e823fa676fba684f5e357ce52e675

SHA512
361b4d21ae96422f9d054d468e4057e245791fe174926f4d3547692748156d298bebbf32140a68742a359fb6ee62eb6ad0e3170a16c87308f34deb1d50491348

Download Submit
memory/1240-78-0x0000000002E60000-0x0000000002E70000-memory.dmp

Filesize
64KB

Download
memory/1240-77-0x00000000003D0000-0x0000000000442000-memory.dmp

Filesize
456KB

Download
memory/1240-72-0x000007FEFC911000-0x000007FEFC913000-memory.dmp

Filesize
8KB

Download
memory/1240-71-0x00000000003D0000-0x0000000000442000-memory.dmp

Filesize
456KB

Download
memory/1440-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1440-68-0x0000000074FB0000-0x000000007555B000-memory.dmp

Filesize
5.7MB

Download
memory/2020-69-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2020-67-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2020-65-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2020-59-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2020-74-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2020-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2020-60-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2020-58-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2020-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2020-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads