Overview

overview

10

Static

static

1

x.dll

windows10-1703-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-02-2023 15:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    x.dll

  • Size

    676KB

  • MD5

    24d3053553df1154d1fb54fd42280a11

  • SHA1

    11ccb1e60a006fbb16dc22943bc02c8ead438e63

  • SHA256

    547fedb6eb80520a462cb62b7981e9c6a0078d5ce3ccb04528638677207d0f52

  • SHA512

    7b8dd915ae965abbff302a10d9cc2c9ecd0c918599311a2a5328c4e9880d661beb0f9c3421f42d0f01ba6a7a69542205551e6101798fb304679b650e1ff4b4f1

  • SSDEEP

    12288:Zcm3gYGSxS1mSki7mJMXU2UNIHPc3dzlTyZrXOp9u0LN29BBaSAeLlNu/EvVmltT:Zcm3IqwmJMXPHPc3dr9LQDBaSAsNIEve

Score
10/10
gozi1000bankerldr4trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1000

C2

https://colodart.top

Attributes
  • host_keep_time

    2

  • host_shift_time

    1

  • idle_time

    1

  • request_time

    10

aes.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\x.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Windows\system32\cmd.exe
      cmd /c "nltest /dclist:" >> C:\Users\Admin\AppData\Local\Temp\150E.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Windows\system32\nltest.exe
        nltest /dclist:
        3⤵
          PID:4540
      • C:\Windows\system32\cmd.exe
        cmd /c "net group "domain computers" /domain" >> C:\Users\Admin\AppData\Local\Temp\3CFB.tmp
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1452
        • C:\Windows\system32\net.exe
          net group "domain computers" /domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2864
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 group "domain computers" /domain
            4⤵
              PID:4464
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4312

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      Peripheral Device Discovery

      1
      T1120

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\150E.tmp
        Filesize

        36B

        MD5

        c58986635c266e6c06609b908580bede

        SHA1

        4672dce03d3dd9560cf74035aff3d9aebb7201e4

        SHA256

        a2f1bb2817f976e129974b003e3ec12fb8a644c1952bb667116317fd26416042

        SHA512

        36241e4bda8ad7e4137624bbfbb999c643d34a2095ba078f9886d92f4726913bdb9dc1e1f44141a6738c1e4d9042b802e49f774c0f1c6901735f4b069834449f

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\3CFB.tmp
        Filesize

        78B

        MD5

        aaec14b2de8e2fdaf8427672122af65c

        SHA1

        ca953efad669c93af85b968d747baa544d4465fb

        SHA256

        14c94c44d0eb89a820d96e1791f4b754c87ee778b5f4478289df0fb22e1c3da1

        SHA512

        a5cbad3de5070fdcd6aa7f3f5eda42b69faef44a431cf48e20ca1f4f42c648ee80bd5f1d9b981624ae6b39e2435b4278c9fd1e97491e3b244a2bba7d629021a8

        Download Submit
      • memory/3232-117-0x00000000022C0000-0x0000000002373000-memory.dmp
        Filesize

        716KB

        Download
      • memory/3232-119-0x0000000180000000-0x0000000180014000-memory.dmp
        Filesize

        80KB

        Download
      • memory/3232-125-0x0000000002490000-0x00000000024A3000-memory.dmp
        Filesize

        76KB

        Download
      • memory/3232-130-0x0000000002450000-0x0000000002451000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3232-136-0x00000000022C0000-0x0000000002373000-memory.dmp
        Filesize

        716KB

        Download