gozi | cfe6b53554aaf19a2adf3a64ac5133705d6529396de72a80f88a9446ed5ccc6f

Analysis

max time kernel
92s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2023 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Agenzia_Entrate/Informazione_Azienda.exe
Size

716.5MB
MD5

6b2289e478ba947fcdf3162d7dfcc866
SHA1

6ddee30e77c993cc3c7bd7448115b0910ac35f02
SHA256

360662fe225833af7db84c550f8fb9f7afe7333a9b0e2ca436c9c242d9a87975
SHA512

b1334513bd3febd6e2408404fd63d3f59ed6261f28d045686b21ef7f71f9952affef9a72021f7a541fb6b689016c3344c8907a98dd7ce4d1ed9f32ca43f8aebe
SSDEEP

24576:HJqQKnVYxHs6MxrRcnWOVY1st7Xm1KoY9x:QVYNs6yRc6stKR+

Score

10^/10

gozi 7709 banker isfb persistence trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7709

checklist.skype.com

62.173.141.252

31.41.44.33

109.248.11.112

Attributes

base_path
/drew/
build
250255
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	writeruuov.exe

Executes dropped EXE 2 IoCs

pid	Process
3580	writeruuov.exe
1488	writeruuov.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Informazione_Azienda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Informazione_Azienda.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3580 set thread context of 1488	3580	writeruuov.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
936	powershell.exe
936	powershell.exe
1796	powershell.exe
1796	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	3580	writeruuov.exe
Token: SeDebugPrivilege	1796	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 3580	3084	Informazione_Azienda.exe	92
PID 3084 wrote to memory of 3580	3084	Informazione_Azienda.exe	92
PID 3084 wrote to memory of 3580	3084	Informazione_Azienda.exe	92
PID 3580 wrote to memory of 936	3580	writeruuov.exe	95
PID 3580 wrote to memory of 936	3580	writeruuov.exe	95
PID 3580 wrote to memory of 936	3580	writeruuov.exe	95
PID 3580 wrote to memory of 4940	3580	writeruuov.exe	99
PID 3580 wrote to memory of 4940	3580	writeruuov.exe	99
PID 3580 wrote to memory of 4940	3580	writeruuov.exe	99
PID 3580 wrote to memory of 1488	3580	writeruuov.exe	101
PID 3580 wrote to memory of 1488	3580	writeruuov.exe	101
PID 3580 wrote to memory of 1488	3580	writeruuov.exe	101
PID 3580 wrote to memory of 1488	3580	writeruuov.exe	101
PID 3580 wrote to memory of 1488	3580	writeruuov.exe	101
PID 3580 wrote to memory of 1488	3580	writeruuov.exe	101
PID 3580 wrote to memory of 1488	3580	writeruuov.exe	101
PID 3580 wrote to memory of 1488	3580	writeruuov.exe	101
PID 3580 wrote to memory of 1488	3580	writeruuov.exe	101
PID 3580 wrote to memory of 1488	3580	writeruuov.exe	101
PID 3580 wrote to memory of 1488	3580	writeruuov.exe	101
PID 4940 wrote to memory of 1796	4940	cmd.exe	102
PID 4940 wrote to memory of 1796	4940	cmd.exe	102
PID 4940 wrote to memory of 1796	4940	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\Agenzia_Entrate\Informazione_Azienda.exe
"C:\Users\Admin\AppData\Local\Temp\Agenzia_Entrate\Informazione_Azienda.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1796
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
    3⤵
    - Executes dropped EXE
    PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
3d242231f810427e4c58f7419bd13d1a

SHA1
23213639533255a852b40bde563eb053876edc1c

SHA256
49edeb2bb836600acb8488eaa456b01254a350c504fa7840a1f76bfaa3de4172

SHA512
337109c06f4bc8721af6c3c8d30d0d98728e7a72ce31db15148c430d6dbf8e4de5dd5547571064df15d95f6b2c263c2284273930fb5a52c54971b29a82d93e2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe

Filesize
364.1MB

MD5
e1dc3c1f4a5adf277a6f070f135aff38

SHA1
9ebae917de2ea4cac0575d6008ae642b2506e08e

SHA256
4fb3399cf3ea5d250bd5460d78f34e7c9b65da03b92f0336c4cd29d44df8e4a2

SHA512
34e960756c22cdea2f62d945de4618ba57dbc3ee23cd27549eb5a274fd36d1c618c70970c9003f5a090f45869ea8782bdcf717d8a6cf8656bb729ff8d15e07b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe

Filesize
364.1MB

MD5
e1dc3c1f4a5adf277a6f070f135aff38

SHA1
9ebae917de2ea4cac0575d6008ae642b2506e08e

SHA256
4fb3399cf3ea5d250bd5460d78f34e7c9b65da03b92f0336c4cd29d44df8e4a2

SHA512
34e960756c22cdea2f62d945de4618ba57dbc3ee23cd27549eb5a274fd36d1c618c70970c9003f5a090f45869ea8782bdcf717d8a6cf8656bb729ff8d15e07b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe

Filesize
364.1MB

MD5
e1dc3c1f4a5adf277a6f070f135aff38

SHA1
9ebae917de2ea4cac0575d6008ae642b2506e08e

SHA256
4fb3399cf3ea5d250bd5460d78f34e7c9b65da03b92f0336c4cd29d44df8e4a2

SHA512
34e960756c22cdea2f62d945de4618ba57dbc3ee23cd27549eb5a274fd36d1c618c70970c9003f5a090f45869ea8782bdcf717d8a6cf8656bb729ff8d15e07b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kzsq1f0j.pgf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/936-166-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/936-164-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/936-145-0x0000000005570000-0x0000000005B98000-memory.dmp

Filesize
6.2MB

Download
memory/936-146-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/936-147-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/936-148-0x0000000005C90000-0x0000000005CF6000-memory.dmp

Filesize
408KB

Download
memory/936-149-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Filesize
408KB

Download
memory/936-144-0x0000000004E20000-0x0000000004E56000-memory.dmp

Filesize
216KB

Download
memory/936-159-0x0000000006400000-0x000000000641E000-memory.dmp

Filesize
120KB

Download
memory/936-160-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/936-161-0x0000000007C10000-0x000000000828A000-memory.dmp

Filesize
6.5MB

Download
memory/936-162-0x00000000068E0000-0x00000000068FA000-memory.dmp

Filesize
104KB

Download
memory/936-165-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/1488-185-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1488-184-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1488-221-0x0000000000DB0000-0x0000000000DBD000-memory.dmp

Filesize
52KB

Download
memory/1488-220-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1488-180-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1796-197-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/1796-218-0x0000000007B90000-0x0000000007B98000-memory.dmp

Filesize
32KB

Download
memory/1796-217-0x0000000007BB0000-0x0000000007BCA000-memory.dmp

Filesize
104KB

Download
memory/1796-216-0x00000000064F0000-0x00000000064FE000-memory.dmp

Filesize
56KB

Download
memory/1796-214-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/1796-198-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/1796-215-0x0000000007C50000-0x0000000007CE6000-memory.dmp

Filesize
600KB

Download
memory/1796-200-0x0000000006C30000-0x0000000006C62000-memory.dmp

Filesize
200KB

Download
memory/1796-201-0x0000000070B40000-0x0000000070B8C000-memory.dmp

Filesize
304KB

Download
memory/1796-211-0x0000000006BB0000-0x0000000006BCE000-memory.dmp

Filesize
120KB

Download
memory/1796-212-0x0000000007A00000-0x0000000007A0A000-memory.dmp

Filesize
40KB

Download
memory/1796-213-0x000000007F700000-0x000000007F710000-memory.dmp

Filesize
64KB

Download
memory/3580-143-0x0000000006500000-0x0000000006522000-memory.dmp

Filesize
136KB

Download
memory/3580-138-0x0000000000E10000-0x0000000000FC2000-memory.dmp

Filesize
1.7MB

Download
memory/3580-139-0x0000000005E90000-0x0000000006434000-memory.dmp

Filesize
5.6MB

Download
memory/3580-140-0x0000000005980000-0x0000000005A12000-memory.dmp

Filesize
584KB

Download
memory/3580-163-0x0000000005B20000-0x0000000005B30000-memory.dmp

Filesize
64KB

Download
memory/3580-141-0x0000000005A20000-0x0000000005A2A000-memory.dmp

Filesize
40KB

Download
memory/3580-142-0x0000000005B20000-0x0000000005B30000-memory.dmp

Filesize
64KB

Download