Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-03-2024 19:37

General

  • Target

    b97eb20d9cd4df21c713866e51e2aff3.exe

  • Size

    5.3MB

  • MD5

    b97eb20d9cd4df21c713866e51e2aff3

  • SHA1

    3e59b574b543e60e4842fc2df208b78e85cb5916

  • SHA256

    1015ea42f955bb7d199d166800a1831ffda77e2bf81535880fef0cb2f877e614

  • SHA512

    17cf26a872c4a5978f55ce36da14d70eb78f93ca398703c5542efd374bdf1a780614ea664603844a5f16eb29ddd8af66048f71b36c7f496c05937593820bf711

  • SSDEEP

    98304:i3+wQB/D3aG8Ml6y34qm29a3c59gsHYikPTPd8BiBfBaFqm29a3c59gsHYikp:U+wSeab8uZgHXd8+BaxuZgHF

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b97eb20d9cd4df21c713866e51e2aff3.exe
    "C:\Users\Admin\AppData\Local\Temp\b97eb20d9cd4df21c713866e51e2aff3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\b97eb20d9cd4df21c713866e51e2aff3.exe
      C:\Users\Admin\AppData\Local\Temp\b97eb20d9cd4df21c713866e51e2aff3.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\b97eb20d9cd4df21c713866e51e2aff3.exe

    Filesize

    960KB

    MD5

    063c0fe230eabbdfab4e6a79e7e2434d

    SHA1

    585edab5682f0ba59df75fe6cfcc67844cb57ae9

    SHA256

    b797257e984d515b51fd691323f68cce97bb246b55aa92d383214c8bd74becac

    SHA512

    bdc907753ec507cbc34bcd186c6ceb4383709b9786996f2ffdd1fcf684bc0aaf94ee87675ee08ad01d3de827fef03447fecc64d9e9ba3239282f35892ca94387

  • \Users\Admin\AppData\Local\Temp\b97eb20d9cd4df21c713866e51e2aff3.exe

    Filesize

    1.6MB

    MD5

    f83615516a5c73204990df4c89f41e65

    SHA1

    4551d61fef4624dff2354e93d7c04197a6525610

    SHA256

    beae2075ba55d1a86e23993263ba70578cd5425e6831697546724894ed98e547

    SHA512

    60d642e0d97810dcad47daf686de3e775df26a3a3bf3a8e5696803af9613885601e4eb9a12de088eb90d9974d5c513e94c389fbcf198a653c67c65e989f10e83

  • memory/2020-0-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/2020-1-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/2020-2-0x00000000002B0000-0x00000000003E3000-memory.dmp

    Filesize

    1.2MB

  • memory/2020-29-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/2580-14-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/2580-16-0x0000000001B20000-0x0000000001C53000-memory.dmp

    Filesize

    1.2MB

  • memory/2580-15-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/2580-21-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

  • memory/2580-23-0x0000000003410000-0x000000000363A000-memory.dmp

    Filesize

    2.2MB

  • memory/2580-30-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB