gozi | ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959

General

Target

ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959.dll
Size

706KB
MD5

3b69cd2054a8234939a684ed60b7d671
SHA1

1e07e548668918d5db3c7b907ad765f2996ff5c5
SHA256

ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959
SHA512

717b6fa6fe5040474df92377f60918a8c029690cf62fcf6bbbce07e0eabbdfb649720e6a85973d64d1109747de3c2b4cd0f59885ade6e8068e3d6e2a56339b8e
SSDEEP

3072:XGMvz842hp4xCCIaBCpGkWSkx0cf5P0UGwS+9BNmA6a:Xtx2yBCiSkxPNT7Ya

Score

10^/10

gozi 1000 banker ldr4 trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1000

C2

https://ceredovza.top

Attributes

host_keep_time
2
host_shift_time
1
idle_time
1
request_time
10

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Runs net.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

regsvr32.execmd.execmd.exenet.exe

description	pid	process	target process
PID 1472 wrote to memory of 1824	1472	regsvr32.exe	cmd.exe
PID 1472 wrote to memory of 1824	1472	regsvr32.exe	cmd.exe
PID 1472 wrote to memory of 1824	1472	regsvr32.exe	cmd.exe
PID 1824 wrote to memory of 1992	1824	cmd.exe	nltest.exe
PID 1824 wrote to memory of 1992	1824	cmd.exe	nltest.exe
PID 1824 wrote to memory of 1992	1824	cmd.exe	nltest.exe
PID 1472 wrote to memory of 1928	1472	regsvr32.exe	cmd.exe
PID 1472 wrote to memory of 1928	1472	regsvr32.exe	cmd.exe
PID 1472 wrote to memory of 1928	1472	regsvr32.exe	cmd.exe
PID 1928 wrote to memory of 776	1928	cmd.exe	net.exe
PID 1928 wrote to memory of 776	1928	cmd.exe	net.exe
PID 1928 wrote to memory of 776	1928	cmd.exe	net.exe
PID 776 wrote to memory of 896	776	net.exe	net1.exe
PID 776 wrote to memory of 896	776	net.exe	net1.exe
PID 776 wrote to memory of 896	776	net.exe	net1.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\system32\cmd.exe
cmd /c "nltest /dclist:" >> C:\Users\Admin\AppData\Local\Temp\FCDC.tmp
2⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\system32\nltest.exe
nltest /dclist:
3⤵
PID:1992

C:\Windows\system32\cmd.exe
cmd /c "net group "domain computers" /domain" >> C:\Users\Admin\AppData\Local\Temp\824.tmp
2⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\system32\net.exe
net group "domain computers" /domain
3⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 group "domain computers" /domain
4⤵
PID:896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1d8e5323ec15e7755d41caaf73e7ba34

SHA1
e6f83d808312dcbdf88c6a44da8456d0aa97907c

SHA256
a0dfb7eb23956d9a785ad485e6cd87410ff30e65fab8c5097415770cf5f2ecde

SHA512
63765ee044ddaa8e46c2f0a23205a43571263aa23f725909de35c52fb0097f67dfa57371e4debaaf0e7ea91d7c916ca718f14d1d56c4abcbefe80033c31e1e71

Download Submit
C:\Users\Admin\AppData\Local\Temp\824.tmp
Filesize
78B

MD5
aaec14b2de8e2fdaf8427672122af65c

SHA1
ca953efad669c93af85b968d747baa544d4465fb

SHA256
14c94c44d0eb89a820d96e1791f4b754c87ee778b5f4478289df0fb22e1c3da1

SHA512
a5cbad3de5070fdcd6aa7f3f5eda42b69faef44a431cf48e20ca1f4f42c648ee80bd5f1d9b981624ae6b39e2435b4278c9fd1e97491e3b244a2bba7d629021a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2159.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\FCDC.tmp
Filesize
36B

MD5
c58986635c266e6c06609b908580bede

SHA1
4672dce03d3dd9560cf74035aff3d9aebb7201e4

SHA256
a2f1bb2817f976e129974b003e3ec12fb8a644c1952bb667116317fd26416042

SHA512
36241e4bda8ad7e4137624bbfbb999c643d34a2095ba078f9886d92f4726913bdb9dc1e1f44141a6738c1e4d9042b802e49f774c0f1c6901735f4b069834449f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2537.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
memory/1472-54-0x0000000180000000-0x0000000180014000-memory.dmp

Filesize
80KB

Download
memory/1472-58-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/1472-64-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1472-135-0x0000000064880000-0x0000000064930000-memory.dmp

Filesize
704KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads