Overview

overview

10

Static

static

500716a46d...81.exe

windows7-x64

10

500716a46d...81.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2022 19:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe

  • Size

    243KB

  • MD5

    c2db310b19a07816183638816938eb5d

  • SHA1

    ea5d7cfd5d278f019a77b99cfac9a8e0709d591e

  • SHA256

    500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781

  • SHA512

    54cd7c8c5b100e222dd53f338f6f4b8d2fb1fc55db36e848288881b1b5e4ad8200b0cc45d2d36f54bff9faff55e4d49a54a17b866687d2905789a20375eaf772

  • SSDEEP

    6144:x4y6j8ncpnrKlEtSfTKfRn/kXfMbpuUW:uVAcpnulEEfWfR/YMbp

Score
10/10
gozi1000bankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1000

C2

goliathuz.com

musicvideoporntip3s.ru
Attributes
  • exe_type

    worker

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 60 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe
    "C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe
      "C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe"
      2⤵
        PID:4900
      • C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe
        "C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe"
        2⤵
        • Checks computer location settings
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          3⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1052
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240604437.bat" "C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2312
          • C:\Windows\SysWOW64\attrib.exe
            attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe"
            4⤵
            • Views/modifies file attributes
            PID:4072
      • C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe
        "C:\Users\Admin\AppData\Local\Temp\500716a46d057b920870230dcb2361dccf489a2b8fd7938fc6f8269f7eea8781.exe"
        2⤵
          PID:2520
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5104
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4400

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\240604437.bat
        Filesize

        76B

        MD5

        01cc72bfb620ecc8d293c8c4f7811001

        SHA1

        6e66d17a336f2efc5157bd84690c4a4817658da8

        SHA256

        e1f6967ce4d0782589f5d432464626dc5f4e3dbb4c9bdbadaa50c4b2fa869c21

        SHA512

        462f971c6efaea58b8e2410ddee9cc1ca6f8a438ecfd5619afd22a6fdc37e065d417b031569a4b988ed2f6c3f57fcc528b57d1b61d07a5e112105efe88ace5bb

        Download Submit

      • memory/1484-134-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1484-135-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1484-138-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1484-140-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

        Download

      • memory/4896-136-0x0000000074860000-0x0000000074E11000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/4896-132-0x00000000015DC000-0x00000000015E1000-memory.dmp

        Filesize

        20KB

        Download

      • memory/4896-137-0x00000000015DE000-0x00000000015E1000-memory.dmp

        Filesize

        12KB

        Download

      • memory/5104-152-0x0000025945318000-0x0000025945320000-memory.dmp

        Filesize

        32KB

        Download

      • memory/5104-154-0x0000025945C90000-0x0000025945CB0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5104-160-0x00000259583E0000-0x00000259584E0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/5104-158-0x0000025945C90000-0x0000025945CB0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5104-181-0x0000025945D50000-0x0000025945D70000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5104-195-0x0000025948320000-0x0000025948340000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5104-296-0x0000025945490000-0x00000259454B0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5104-304-0x0000025958630000-0x0000025958650000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5104-328-0x0000025945CF0000-0x0000025945D10000-memory.dmp

        Filesize

        128KB

        Download