gozi | f52c313277246ccd81420797967aff0a7353fe0f6badc77817e842120072efbd

Analysis

max time kernel
137s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/03/2023, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Agenzia_Entrate/Informazione_Azienda.exe
Size

716.5MB
MD5

ff3b830fa123ed115813456f35ba6520
SHA1

1f4259eaee9e670d8cd90a769662b87c49d2024f
SHA256

819ac014854275274b05b1c162e4cdd184ef8d94dffbf20e84e0c820e4ecb33f
SHA512

bb1161ecba1f03811635f9bab46776ba6de0ba2a2613da4466f0eb6b6f5594f6d2d621f93533a0114abfb0c2c503b4302e7e20c01f913fe1e2d1470b1b12ce86
SSDEEP

12288:AiAQgT3n+nqYJrHsanMmkDC61RcnfREOD3GzIkZ1sOY77Xmtw8yEdKFSX:ALQYnVYxHs6MxrRcnWOVY1st7Xm1KoX

Score

10^/10

gozi 7709 banker isfb persistence trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7709

checklist.skype.com

62.173.141.252

31.41.44.33

109.248.11.112

Attributes

base_path
/drew/
build
250255
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Executes dropped EXE 2 IoCs

pid	Process
2024	writeruuov.exe
304	writeruuov.exe

Loads dropped DLL 1 IoCs

pid	Process
2024	writeruuov.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Informazione_Azienda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Informazione_Azienda.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 304	2024	writeruuov.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1304	powershell.exe
568	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	2024	writeruuov.exe
Token: SeDebugPrivilege	568	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2024	2020	Informazione_Azienda.exe	27
PID 2020 wrote to memory of 2024	2020	Informazione_Azienda.exe	27
PID 2020 wrote to memory of 2024	2020	Informazione_Azienda.exe	27
PID 2020 wrote to memory of 2024	2020	Informazione_Azienda.exe	27
PID 2024 wrote to memory of 1304	2024	writeruuov.exe	28
PID 2024 wrote to memory of 1304	2024	writeruuov.exe	28
PID 2024 wrote to memory of 1304	2024	writeruuov.exe	28
PID 2024 wrote to memory of 1304	2024	writeruuov.exe	28
PID 2024 wrote to memory of 1476	2024	writeruuov.exe	30
PID 2024 wrote to memory of 1476	2024	writeruuov.exe	30
PID 2024 wrote to memory of 1476	2024	writeruuov.exe	30
PID 2024 wrote to memory of 1476	2024	writeruuov.exe	30
PID 1476 wrote to memory of 568	1476	cmd.exe	32
PID 1476 wrote to memory of 568	1476	cmd.exe	32
PID 1476 wrote to memory of 568	1476	cmd.exe	32
PID 1476 wrote to memory of 568	1476	cmd.exe	32
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33
PID 2024 wrote to memory of 304	2024	writeruuov.exe	33

C:\Users\Admin\AppData\Local\Temp\Agenzia_Entrate\Informazione_Azienda.exe
"C:\Users\Admin\AppData\Local\Temp\Agenzia_Entrate\Informazione_Azienda.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:568
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe
    3⤵
    - Executes dropped EXE
    PID:304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe

Filesize
364.1MB

MD5
e1dc3c1f4a5adf277a6f070f135aff38

SHA1
9ebae917de2ea4cac0575d6008ae642b2506e08e

SHA256
4fb3399cf3ea5d250bd5460d78f34e7c9b65da03b92f0336c4cd29d44df8e4a2

SHA512
34e960756c22cdea2f62d945de4618ba57dbc3ee23cd27549eb5a274fd36d1c618c70970c9003f5a090f45869ea8782bdcf717d8a6cf8656bb729ff8d15e07b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe

Filesize
364.1MB

MD5
e1dc3c1f4a5adf277a6f070f135aff38

SHA1
9ebae917de2ea4cac0575d6008ae642b2506e08e

SHA256
4fb3399cf3ea5d250bd5460d78f34e7c9b65da03b92f0336c4cd29d44df8e4a2

SHA512
34e960756c22cdea2f62d945de4618ba57dbc3ee23cd27549eb5a274fd36d1c618c70970c9003f5a090f45869ea8782bdcf717d8a6cf8656bb729ff8d15e07b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe

Filesize
364.1MB

MD5
e1dc3c1f4a5adf277a6f070f135aff38

SHA1
9ebae917de2ea4cac0575d6008ae642b2506e08e

SHA256
4fb3399cf3ea5d250bd5460d78f34e7c9b65da03b92f0336c4cd29d44df8e4a2

SHA512
34e960756c22cdea2f62d945de4618ba57dbc3ee23cd27549eb5a274fd36d1c618c70970c9003f5a090f45869ea8782bdcf717d8a6cf8656bb729ff8d15e07b3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FZC2TI186HWK7UKOC2HT.temp

Filesize
7KB

MD5
2baaeed552cec53f4dd6d874b64d5033

SHA1
4540f9d07df969c444ba858704b1e71155d10330

SHA256
58db02d2bbaf4e61b58ffa74760c98b40b3a5ff88b5e6a41ba2b6f0cfd29f6e4

SHA512
20a77baf2c1f162c0d46b8047e8660d6410d7900e755e2225a9be94bd5164f8811edc4965d70c215ce07720796c8242a4d06879327a65cfd84220dca2a0023d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
2baaeed552cec53f4dd6d874b64d5033

SHA1
4540f9d07df969c444ba858704b1e71155d10330

SHA256
58db02d2bbaf4e61b58ffa74760c98b40b3a5ff88b5e6a41ba2b6f0cfd29f6e4

SHA512
20a77baf2c1f162c0d46b8047e8660d6410d7900e755e2225a9be94bd5164f8811edc4965d70c215ce07720796c8242a4d06879327a65cfd84220dca2a0023d1

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\writeruuov.exe

Filesize
364.1MB

MD5
e1dc3c1f4a5adf277a6f070f135aff38

SHA1
9ebae917de2ea4cac0575d6008ae642b2506e08e

SHA256
4fb3399cf3ea5d250bd5460d78f34e7c9b65da03b92f0336c4cd29d44df8e4a2

SHA512
34e960756c22cdea2f62d945de4618ba57dbc3ee23cd27549eb5a274fd36d1c618c70970c9003f5a090f45869ea8782bdcf717d8a6cf8656bb729ff8d15e07b3

Download Submit
memory/304-86-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/304-87-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/304-93-0x00000000001F0000-0x00000000001FD000-memory.dmp

Filesize
52KB

Download
memory/304-92-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/304-91-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/304-84-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/304-83-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/304-82-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/304-81-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/304-79-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/304-80-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/568-90-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/1304-71-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/1304-67-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/1304-70-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/1304-69-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/1304-68-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/2024-62-0x0000000004AD0000-0x0000000004C10000-memory.dmp

Filesize
1.2MB

Download
memory/2024-63-0x00000000045F0000-0x0000000004682000-memory.dmp

Filesize
584KB

Download
memory/2024-64-0x0000000005110000-0x0000000005150000-memory.dmp

Filesize
256KB

Download
memory/2024-61-0x0000000005110000-0x0000000005150000-memory.dmp

Filesize
256KB

Download
memory/2024-60-0x0000000000BE0000-0x0000000000D92000-memory.dmp

Filesize
1.7MB

Download