gozi | cfe6b53554aaf19a2adf3a64ac5133705d6529396de72a80f88a9446ed5ccc6f

Analysis

max time kernel
96s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-03-2023 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Agenzia_Entrate/Informazione_Azienda.exe
Size

716.5MB
MD5

6b2289e478ba947fcdf3162d7dfcc866
SHA1

6ddee30e77c993cc3c7bd7448115b0910ac35f02
SHA256

360662fe225833af7db84c550f8fb9f7afe7333a9b0e2ca436c9c242d9a87975
SHA512

b1334513bd3febd6e2408404fd63d3f59ed6261f28d045686b21ef7f71f9952affef9a72021f7a541fb6b689016c3344c8907a98dd7ce4d1ed9f32ca43f8aebe
SSDEEP

24576:HJqQKnVYxHs6MxrRcnWOVY1st7Xm1KoY9x:QVYNs6yRc6stKR+

Score

10^/10

gozi 7709 banker isfb persistence trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7709

checklist.skype.com

62.173.141.252

31.41.44.33

109.248.11.112

Attributes

base_path
/drew/
build
250255
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Executes dropped EXE 2 IoCs

pid	Process
2016	writeruuov.exe
1792	writeruuov.exe

Loads dropped DLL 1 IoCs

pid	Process
2016	writeruuov.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Informazione_Azienda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Informazione_Azienda.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 1792	2016	writeruuov.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1344	powershell.exe
2036	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	2016	writeruuov.exe
Token: SeDebugPrivilege	2036	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2016	1668	Informazione_Azienda.exe	26
PID 1668 wrote to memory of 2016	1668	Informazione_Azienda.exe	26
PID 1668 wrote to memory of 2016	1668	Informazione_Azienda.exe	26
PID 1668 wrote to memory of 2016	1668	Informazione_Azienda.exe	26
PID 2016 wrote to memory of 1344	2016	writeruuov.exe	27
PID 2016 wrote to memory of 1344	2016	writeruuov.exe	27
PID 2016 wrote to memory of 1344	2016	writeruuov.exe	27
PID 2016 wrote to memory of 1344	2016	writeruuov.exe	27
PID 2016 wrote to memory of 1476	2016	writeruuov.exe	29
PID 2016 wrote to memory of 1476	2016	writeruuov.exe	29
PID 2016 wrote to memory of 1476	2016	writeruuov.exe	29
PID 2016 wrote to memory of 1476	2016	writeruuov.exe	29
PID 1476 wrote to memory of 2036	1476	cmd.exe	31
PID 1476 wrote to memory of 2036	1476	cmd.exe	31
PID 1476 wrote to memory of 2036	1476	cmd.exe	31
PID 1476 wrote to memory of 2036	1476	cmd.exe	31
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32
PID 2016 wrote to memory of 1792	2016	writeruuov.exe	32

C:\Users\Admin\AppData\Local\Temp\Agenzia_Entrate\Informazione_Azienda.exe
"C:\Users\Admin\AppData\Local\Temp\Agenzia_Entrate\Informazione_Azienda.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2036
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
    3⤵
    - Executes dropped EXE
    PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe

Filesize
364.1MB

MD5
e1dc3c1f4a5adf277a6f070f135aff38

SHA1
9ebae917de2ea4cac0575d6008ae642b2506e08e

SHA256
4fb3399cf3ea5d250bd5460d78f34e7c9b65da03b92f0336c4cd29d44df8e4a2

SHA512
34e960756c22cdea2f62d945de4618ba57dbc3ee23cd27549eb5a274fd36d1c618c70970c9003f5a090f45869ea8782bdcf717d8a6cf8656bb729ff8d15e07b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe

Filesize
364.1MB

MD5
e1dc3c1f4a5adf277a6f070f135aff38

SHA1
9ebae917de2ea4cac0575d6008ae642b2506e08e

SHA256
4fb3399cf3ea5d250bd5460d78f34e7c9b65da03b92f0336c4cd29d44df8e4a2

SHA512
34e960756c22cdea2f62d945de4618ba57dbc3ee23cd27549eb5a274fd36d1c618c70970c9003f5a090f45869ea8782bdcf717d8a6cf8656bb729ff8d15e07b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe

Filesize
364.1MB

MD5
e1dc3c1f4a5adf277a6f070f135aff38

SHA1
9ebae917de2ea4cac0575d6008ae642b2506e08e

SHA256
4fb3399cf3ea5d250bd5460d78f34e7c9b65da03b92f0336c4cd29d44df8e4a2

SHA512
34e960756c22cdea2f62d945de4618ba57dbc3ee23cd27549eb5a274fd36d1c618c70970c9003f5a090f45869ea8782bdcf717d8a6cf8656bb729ff8d15e07b3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3UPLKW7DC87VTXSGM0GD.temp

Filesize
7KB

MD5
0be2dff751547b8f2b4d1161f15cc71e

SHA1
0f30040b4446aae062590c9f59e4f318e692a151

SHA256
0de5bdfe474cd4f0ec8acd78d7d638dd35ab638a60d9807cae3675b1877a8dc6

SHA512
50771706585e30b33c0e2fc5dd1f5bc0bc2e132a69088870e4bed3310906a4f583c241ddd87dac268e66cb954d6b7b44e39689a80ace421180a961e935f15a93

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
0be2dff751547b8f2b4d1161f15cc71e

SHA1
0f30040b4446aae062590c9f59e4f318e692a151

SHA256
0de5bdfe474cd4f0ec8acd78d7d638dd35ab638a60d9807cae3675b1877a8dc6

SHA512
50771706585e30b33c0e2fc5dd1f5bc0bc2e132a69088870e4bed3310906a4f583c241ddd87dac268e66cb954d6b7b44e39689a80ace421180a961e935f15a93

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe

Filesize
364.1MB

MD5
e1dc3c1f4a5adf277a6f070f135aff38

SHA1
9ebae917de2ea4cac0575d6008ae642b2506e08e

SHA256
4fb3399cf3ea5d250bd5460d78f34e7c9b65da03b92f0336c4cd29d44df8e4a2

SHA512
34e960756c22cdea2f62d945de4618ba57dbc3ee23cd27549eb5a274fd36d1c618c70970c9003f5a090f45869ea8782bdcf717d8a6cf8656bb729ff8d15e07b3

Download Submit
memory/1344-71-0x00000000023F0000-0x0000000002430000-memory.dmp

Filesize
256KB

Download
memory/1344-67-0x00000000023F0000-0x0000000002430000-memory.dmp

Filesize
256KB

Download
memory/1344-68-0x00000000023F0000-0x0000000002430000-memory.dmp

Filesize
256KB

Download
memory/1344-69-0x00000000023F0000-0x0000000002430000-memory.dmp

Filesize
256KB

Download
memory/1344-70-0x00000000023F0000-0x0000000002430000-memory.dmp

Filesize
256KB

Download
memory/1792-75-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1792-80-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1792-74-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1792-95-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1792-79-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1792-78-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1792-82-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1792-92-0x0000000000030000-0x000000000003D000-memory.dmp

Filesize
52KB

Download
memory/1792-83-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1792-91-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1792-87-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1792-77-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2016-61-0x0000000004EA0000-0x0000000004EE0000-memory.dmp

Filesize
256KB

Download
memory/2016-60-0x0000000001180000-0x0000000001332000-memory.dmp

Filesize
1.7MB

Download
memory/2016-64-0x0000000004EA0000-0x0000000004EE0000-memory.dmp

Filesize
256KB

Download
memory/2016-62-0x0000000004EE0000-0x0000000005020000-memory.dmp

Filesize
1.2MB

Download
memory/2016-63-0x0000000004D30000-0x0000000004DC2000-memory.dmp

Filesize
584KB

Download