gozi | 6da6fa5a959ad50302b32db9fad3862abcbd0597402941d66935203300d52821

Analysis

max time kernel
118s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2023, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Informazion.exe
Size 756KB
Sample230112-m9p61abe8x
SHA256 6da6fa5a959ad50302b32db9fad3862abcbd0597402941d66935203300d52821
MD5 ef4c4f0b7a8cd7b8bd2d2dc6e5982043
SHA1 2374d2dc1ca7f5ebed5386114562ee677eacdb42
SHA512 a9a45702a6d1018b0e685db5f827cd52a6b29e0f20313977c062929af5fb092cda906dc76b7f74fe24cd332921c4a50106bb263ec6f3b932799f2e8171b4fd4c
SSDEEP 3072:oahKyd2n31U5OgWjtGqOh9j2o8zoSg0wK3BG+6s78cv+wUUBrvjCZPkM04Z9OZwi:oahO5LEJIS0wC/f8m+s/M0O9kxU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi 7704 banker isfb persistence trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7704

checklist.skype.com
62.173.149.202
31.41.44.158
193.0.178.157

Attributes

base_path
/drew/
build
250249
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Executes dropped EXE 2 IoCs

pid	Process
4172	maintainabovl.exe
1688	maintainabovl.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	maintainabovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Informazion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Informazion.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4172 set thread context of 1688	4172	maintainabovl.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3112	powershell.exe
3112	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	maintainabovl.exe
Token: SeDebugPrivilege	3112	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4172	4212	Informazion.exe	81
PID 4212 wrote to memory of 4172	4212	Informazion.exe	81
PID 4212 wrote to memory of 4172	4212	Informazion.exe	81
PID 4172 wrote to memory of 3112	4172	maintainabovl.exe	89
PID 4172 wrote to memory of 3112	4172	maintainabovl.exe	89
PID 4172 wrote to memory of 3112	4172	maintainabovl.exe	89
PID 4172 wrote to memory of 1688	4172	maintainabovl.exe	91
PID 4172 wrote to memory of 1688	4172	maintainabovl.exe	91
PID 4172 wrote to memory of 1688	4172	maintainabovl.exe	91
PID 4172 wrote to memory of 1688	4172	maintainabovl.exe	91
PID 4172 wrote to memory of 1688	4172	maintainabovl.exe	91
PID 4172 wrote to memory of 1688	4172	maintainabovl.exe	91
PID 4172 wrote to memory of 1688	4172	maintainabovl.exe	91
PID 4172 wrote to memory of 1688	4172	maintainabovl.exe	91
PID 4172 wrote to memory of 1688	4172	maintainabovl.exe	91
PID 4172 wrote to memory of 1688	4172	maintainabovl.exe	91
PID 4172 wrote to memory of 1688	4172	maintainabovl.exe	91

C:\Users\Admin\AppData\Local\Temp\Informazion.exe
"C:\Users\Admin\AppData\Local\Temp\Informazion.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\maintainabovl.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\maintainabovl.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA4AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\maintainabovl.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\maintainabovl.exe
    3⤵
    - Executes dropped EXE
    PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

maintainabovl.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\maintainabovl.exe
Size 362.4MB
SHA256 c37fc8e08a4dedac07c4a058b243a6bbab08239fd52b36dbe5de9fb114decc59
MD5 b405b1565194722f9457002c4edacbae
SHA1 3a3b6f5a05d8d2e95432abea5241f9fc5178a6fa
SHA512 bf7963ab33052ef586b9f3d0b201f34d7ddce4b3d06f697f505b55a6cd2661e92edc76a34113d83c3c61db7ef12856bf5859353d6dd2f6864d8826934e0a1720
SSDEEP 192:4w2ChcpVaLF/I0mfXXLuWhLsc9Y7ee9aD:4XChcpwLF/ITfXXLuELTrca
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintainabovl.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\maintainabovl.exe
Size 362.4MB
SHA256 c37fc8e08a4dedac07c4a058b243a6bbab08239fd52b36dbe5de9fb114decc59
MD5 b405b1565194722f9457002c4edacbae
SHA1 3a3b6f5a05d8d2e95432abea5241f9fc5178a6fa
SHA512 bf7963ab33052ef586b9f3d0b201f34d7ddce4b3d06f697f505b55a6cd2661e92edc76a34113d83c3c61db7ef12856bf5859353d6dd2f6864d8826934e0a1720
SSDEEP 192:4w2ChcpVaLF/I0mfXXLuWhLsc9Y7ee9aD:4XChcpwLF/ITfXXLuELTrca
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintainabovl.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\maintainabovl.exe
Size 362.4MB
SHA256 c37fc8e08a4dedac07c4a058b243a6bbab08239fd52b36dbe5de9fb114decc59
MD5 b405b1565194722f9457002c4edacbae
SHA1 3a3b6f5a05d8d2e95432abea5241f9fc5178a6fa
SHA512 bf7963ab33052ef586b9f3d0b201f34d7ddce4b3d06f697f505b55a6cd2661e92edc76a34113d83c3c61db7ef12856bf5859353d6dd2f6864d8826934e0a1720
SSDEEP 192:4w2ChcpVaLF/I0mfXXLuWhLsc9Y7ee9aD:4XChcpwLF/ITfXXLuELTrca
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1688-155-0x0000000001380000-0x000000000138D000-memory.dmp

Download

memory/1688-154-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1688-153-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1688-152-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1688-149-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3112-147-0x0000000006E30000-0x0000000006E4A000-memory.dmp

Download

memory/3112-141-0x0000000003380000-0x00000000033B6000-memory.dmp

Download

memory/3112-143-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Download

memory/3112-144-0x0000000005D10000-0x0000000005D76000-memory.dmp

Download

memory/3112-145-0x0000000006980000-0x000000000699E000-memory.dmp

Download

memory/3112-146-0x00000000081C0000-0x000000000883A000-memory.dmp

Download

memory/3112-142-0x0000000005D80000-0x00000000063A8000-memory.dmp

Download

memory/4172-139-0x000000000CD20000-0x000000000CD42000-memory.dmp

Download

memory/4172-138-0x00000000054F0000-0x00000000054FA000-memory.dmp

Download

memory/4172-137-0x0000000005530000-0x00000000055C2000-memory.dmp

Download

memory/4172-136-0x0000000005A00000-0x0000000005FA4000-memory.dmp

Download

memory/4172-135-0x0000000000B30000-0x0000000000B38000-memory.dmp

Download