Analysis

  • max time kernel
    118s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09-03-2024 17:13

General

  • Target

    bc5bf8f1b628a7a66b77b585b176457f.exe

  • Size

    2.7MB

  • MD5

    bc5bf8f1b628a7a66b77b585b176457f

  • SHA1

    22a95c03404a21412039bf5e85a82f9aec362719

  • SHA256

    733ef03c87ac6d0ea07b0f3fa208cb17878dafdac14ef9c69595121579ca5d80

  • SHA512

    256e58715ef684b76f7cac6edd9c56e061bf3ffe0e1b723d23db3fab8fb162369b16bb4b965f4fd1612bb96d6cef5539a478346838db5318449fcbb790901303

  • SSDEEP

    49152:SynDWiL2LIMFyHjE4OtBr4t5sR9b3Wtdaf/wEwJDMya/QP8llF7g4R9j:Jnx28Mntut5sHAaffwJDMya/QPug4Hj

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc5bf8f1b628a7a66b77b585b176457f.exe
    "C:\Users\Admin\AppData\Local\Temp\bc5bf8f1b628a7a66b77b585b176457f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Users\Admin\AppData\Local\Temp\bc5bf8f1b628a7a66b77b585b176457f.exe
      C:\Users\Admin\AppData\Local\Temp\bc5bf8f1b628a7a66b77b585b176457f.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bc5bf8f1b628a7a66b77b585b176457f.exe

    Filesize

    2.7MB

    MD5

    8f88a183d3da07eccb17e5310b517bef

    SHA1

    7f86f88ce429d79d834506f2db23d767b3a58edf

    SHA256

    db0ba7b0ae2ce6feb0d81864df7aabbd5c6fd701481bd9c1baea0161cba305c3

    SHA512

    e44e0d52bf9aade198cc5af1e43933bf1c59555b6e5500ffc57fd9f0b4444e9674889fe53fc2cae56b3232c8a76c5b07ac4643bf025bdf70cb883b856e2c7c84

  • \Users\Admin\AppData\Local\Temp\bc5bf8f1b628a7a66b77b585b176457f.exe

    Filesize

    115KB

    MD5

    1299692d9d4c417ae6ad71a4e49f7ca4

    SHA1

    529337caeff26169fbfeaa545cb360de04dcd2aa

    SHA256

    5efe1b815915d2101c87ee0313be87d1002dffd18bdf1e66a2277a5def908166

    SHA512

    661da6313b566f3e9f1b90cddc4382bec06a3c9de5eb7104c765b51dd6f70fd3b8c9fb85c576e530bee56e546528de2ed6dfa8b4b8f806b457f54f18d3a2a93e

  • memory/640-2-0x0000000000260000-0x0000000000391000-memory.dmp

    Filesize

    1.2MB

  • memory/640-0-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB

  • memory/640-13-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

  • memory/640-15-0x0000000003840000-0x0000000003D27000-memory.dmp

    Filesize

    4.9MB

  • memory/640-1-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

  • memory/640-31-0x0000000003840000-0x0000000003D27000-memory.dmp

    Filesize

    4.9MB

  • memory/2632-16-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB

  • memory/2632-18-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

  • memory/2632-17-0x0000000000290000-0x00000000003C1000-memory.dmp

    Filesize

    1.2MB

  • memory/2632-23-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

  • memory/2632-24-0x0000000003500000-0x0000000003722000-memory.dmp

    Filesize

    2.1MB

  • memory/2632-32-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB