gozi | 4fddc495d84c3b30397b2e3de7cdad79d322de9df03fa00bf792f6106a06a06f

Analysis

max time kernel
133s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2023, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Generale_Informazione.exe
Size 708KB
Sample230119-l5mpmscf31
SHA256 4fddc495d84c3b30397b2e3de7cdad79d322de9df03fa00bf792f6106a06a06f
MD5 4eeb4ef9baa950b337e128ea45f2a902
SHA1 af73ad6f099c389bfd3a271f94173e9aca84bc48
SHA512 1ae3aacb191daa5d2c9b0dca832658cdfa32563b6b0a3e1714923dc28738988b9fce91e733a5d5a5ef3ea3bb7a616a8f37d3aa3ef48d3597dd7c44c45b13ccf9
SSDEEP 1536:srae78zjORCDGwfdCSog01313js5gccF8OlntFdMBgtjw3r74D7eAOqJJot5pVOz:0ahKyd2n31I5KPlntkBu7viRynTuPY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi 7706 banker isfb persistence trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7706

checklist.skype.com
62.173.147.43
31.41.44.157
193.233.175.98

Attributes

base_path
/drew/
build
250250
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Executes dropped EXE 2 IoCs

pid	Process
4876	officerpov.exe
3000	officerpov.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	officerpov.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Generale_Informazione.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Generale_Informazione.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4876 set thread context of 3000	4876	officerpov.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3848	powershell.exe
3848	powershell.exe
2616	powershell.exe
2616	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	officerpov.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 4876	3224	Generale_Informazione.exe	81
PID 3224 wrote to memory of 4876	3224	Generale_Informazione.exe	81
PID 3224 wrote to memory of 4876	3224	Generale_Informazione.exe	81
PID 4876 wrote to memory of 3848	4876	officerpov.exe	89
PID 4876 wrote to memory of 3848	4876	officerpov.exe	89
PID 4876 wrote to memory of 3848	4876	officerpov.exe	89
PID 4876 wrote to memory of 3580	4876	officerpov.exe	91
PID 4876 wrote to memory of 3580	4876	officerpov.exe	91
PID 4876 wrote to memory of 3580	4876	officerpov.exe	91
PID 3580 wrote to memory of 2616	3580	cmd.exe	93
PID 3580 wrote to memory of 2616	3580	cmd.exe	93
PID 3580 wrote to memory of 2616	3580	cmd.exe	93
PID 4876 wrote to memory of 3000	4876	officerpov.exe	94
PID 4876 wrote to memory of 3000	4876	officerpov.exe	94
PID 4876 wrote to memory of 3000	4876	officerpov.exe	94
PID 4876 wrote to memory of 3000	4876	officerpov.exe	94
PID 4876 wrote to memory of 3000	4876	officerpov.exe	94
PID 4876 wrote to memory of 3000	4876	officerpov.exe	94
PID 4876 wrote to memory of 3000	4876	officerpov.exe	94
PID 4876 wrote to memory of 3000	4876	officerpov.exe	94
PID 4876 wrote to memory of 3000	4876	officerpov.exe	94
PID 4876 wrote to memory of 3000	4876	officerpov.exe	94
PID 4876 wrote to memory of 3000	4876	officerpov.exe	94

C:\Users\Admin\AppData\Local\Temp\Generale_Informazione.exe
"C:\Users\Admin\AppData\Local\Temp\Generale_Informazione.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\officerpov.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\officerpov.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2616
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\officerpov.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\officerpov.exe
    3⤵
    - Executes dropped EXE
    PID:3000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
MD5 6195a91754effb4df74dbc72cdf4f7a6
SHA1 aba262f5726c6d77659fe0d3195e36a85046b427
SHA512 ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 a13b62c02f9a9c2f40db500c17f06a8c369afcb8da0d5ef31bc86d01d8a02ace
MD5 192af36e33f4ef0fad580b0e9500d5fd
SHA1 750a72e2199dc7b8969286ca82a518a3ba95ca64
SHA512 41d000f33c8dce399979ddb688156355240daffe94ca07b707876e5bc069f550ac83638f20cb03c6279eac963ef7aaa5f29343f5adc35b803358fe4fc3101121
SSDEEP 384:8b+j39i+swBzWIy4izJkoo9o2TVK6seYZIF/r03SoZEfYSPgjE0L2Q:o377Hedo2TVNy6YSLReE0z
MD5 SHA1 SHA512 SSDEEP

Submit Download

officerpov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\officerpov.exe
Size 362.4MB
SHA256 a9e3dce26dc0db5523faa792629316766dbfa8606a811d7f20ce6dd3d2d1e0c4
MD5 d65a65c05982f8aa6ae79e361bfd63b6
SHA1 e47e3e556b4f25676c77bd16266f3c626aa49c4b
SHA512 cbc384c5dde7592897c02fd23c6360b7ef3481b4d0811bfa7e436d8ebb784adbdf85ec5310462a2fa6954adae5e62d542aa278a2e995334493bb9e97b4cd0025
SSDEEP 768:VsuEESfgqIBIqXhSM8A4+++1vjs9+iqti12BFy+cMf:3/9qKIfi7AtB6FyJI
MD5 SHA1 SHA512 SSDEEP

Submit Download

officerpov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\officerpov.exe
Size 362.4MB
SHA256 a9e3dce26dc0db5523faa792629316766dbfa8606a811d7f20ce6dd3d2d1e0c4
MD5 d65a65c05982f8aa6ae79e361bfd63b6
SHA1 e47e3e556b4f25676c77bd16266f3c626aa49c4b
SHA512 cbc384c5dde7592897c02fd23c6360b7ef3481b4d0811bfa7e436d8ebb784adbdf85ec5310462a2fa6954adae5e62d542aa278a2e995334493bb9e97b4cd0025
SSDEEP 768:VsuEESfgqIBIqXhSM8A4+++1vjs9+iqti12BFy+cMf:3/9qKIfi7AtB6FyJI
MD5 SHA1 SHA512 SSDEEP

Submit Download

officerpov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\officerpov.exe
Size 362.4MB
SHA256 a9e3dce26dc0db5523faa792629316766dbfa8606a811d7f20ce6dd3d2d1e0c4
MD5 d65a65c05982f8aa6ae79e361bfd63b6
SHA1 e47e3e556b4f25676c77bd16266f3c626aa49c4b
SHA512 cbc384c5dde7592897c02fd23c6360b7ef3481b4d0811bfa7e436d8ebb784adbdf85ec5310462a2fa6954adae5e62d542aa278a2e995334493bb9e97b4cd0025
SSDEEP 768:VsuEESfgqIBIqXhSM8A4+++1vjs9+iqti12BFy+cMf:3/9qKIfi7AtB6FyJI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2616-160-0x00000000715E0000-0x000000007162C000-memory.dmp

Download

memory/2616-166-0x0000000007D10000-0x0000000007D18000-memory.dmp

Download

memory/2616-162-0x00000000065F0000-0x00000000065FA000-memory.dmp

Download

memory/2616-161-0x0000000006D00000-0x0000000006D1E000-memory.dmp

Download

memory/2616-159-0x0000000006D90000-0x0000000006DC2000-memory.dmp

Download

memory/2616-164-0x0000000006620000-0x000000000662E000-memory.dmp

Download

memory/2616-165-0x0000000007D30000-0x0000000007D4A000-memory.dmp

Download

memory/2616-163-0x0000000007D70000-0x0000000007E06000-memory.dmp

Download

memory/3000-155-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3000-156-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3000-152-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3000-167-0x00000000005E0000-0x00000000005ED000-memory.dmp

Download

memory/3848-142-0x0000000005470000-0x0000000005A98000-memory.dmp

Download

memory/3848-147-0x00000000068A0000-0x00000000068BA000-memory.dmp

Download

memory/3848-146-0x0000000007A00000-0x000000000807A000-memory.dmp

Download

memory/3848-145-0x0000000006390000-0x00000000063AE000-memory.dmp

Download

memory/3848-144-0x0000000005E60000-0x0000000005EC6000-memory.dmp

Download

memory/3848-143-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Download

memory/3848-141-0x0000000004E00000-0x0000000004E36000-memory.dmp

Download

memory/4876-136-0x0000000005000000-0x00000000055A4000-memory.dmp

Download

memory/4876-139-0x00000000065C0000-0x00000000065E2000-memory.dmp

Download

memory/4876-138-0x0000000004AD0000-0x0000000004ADA000-memory.dmp

Download

memory/4876-137-0x0000000004AF0000-0x0000000004B82000-memory.dmp

Download

memory/4876-135-0x0000000000100000-0x0000000000112000-memory.dmp

Download