gozi | cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

5.9MB
MD5

d21ebfa5e971bb5293c9de7a404792a1
SHA1

850cae6b28d100738547f8a86889d71ff5289073
SHA256

cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b
SHA512

2fe8f296117e70a05fa24f0be9250fff84af339eed1bfe46d1c218a0210324b9e0f77ddaf6ad518eca8370fc3023238f7fa13f483f30c545c10fc2e02f973a6f
SSDEEP

49152:VdFCDWU2GG8XKQ3/cdt4osAZo5+cSAsAUSNlLOg/L1Jf2jTiQ/VoJu4E9/+j9Z29:VnCDL2uKecbO4ihsAUoDjj233NmmcPK7

Score

10^/10

gozi risepro zgrat banker isfb rat stealer trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

risepro

193.233.132.159:50500

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4768-1-0x0000000000610000-0x0000000000BF2000-memory.dmp	family_zgrat_v1

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
4768	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 1480	4768	file.exe	102

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3272	4768	WerFault.exe	84

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2020	4768	file.exe	101
PID 4768 wrote to memory of 2020	4768	file.exe	101
PID 4768 wrote to memory of 2020	4768	file.exe	101
PID 4768 wrote to memory of 1480	4768	file.exe	102
PID 4768 wrote to memory of 1480	4768	file.exe	102
PID 4768 wrote to memory of 1480	4768	file.exe	102
PID 4768 wrote to memory of 1480	4768	file.exe	102
PID 4768 wrote to memory of 1480	4768	file.exe	102
PID 4768 wrote to memory of 1480	4768	file.exe	102
PID 4768 wrote to memory of 1480	4768	file.exe	102
PID 4768 wrote to memory of 1480	4768	file.exe	102
PID 4768 wrote to memory of 1480	4768	file.exe	102
PID 4768 wrote to memory of 1480	4768	file.exe	102

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:2020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 1028
  2⤵
  - Program crash
  PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4768 -ip 4768
1⤵
PID:4476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/1480-31-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/1480-29-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/1480-28-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/1480-27-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/1480-25-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/4768-19-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/4768-22-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/4768-9-0x0000000007620000-0x00000000077B2000-memory.dmp

Filesize
1.6MB

Download
memory/4768-7-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/4768-15-0x0000000003080000-0x0000000003090000-memory.dmp

Filesize
64KB

Download
memory/4768-0-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/4768-18-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/4768-17-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/4768-16-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/4768-8-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/4768-21-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/4768-20-0x0000000007CB0000-0x0000000007DB0000-memory.dmp

Filesize
1024KB

Download
memory/4768-23-0x0000000007CB0000-0x0000000007DB0000-memory.dmp

Filesize
1024KB

Download
memory/4768-6-0x00000000071E0000-0x0000000007514000-memory.dmp

Filesize
3.2MB

Download
memory/4768-5-0x0000000005620000-0x0000000005640000-memory.dmp

Filesize
128KB

Download
memory/4768-4-0x0000000005CB0000-0x00000000061DC000-memory.dmp

Filesize
5.2MB

Download
memory/4768-3-0x0000000005660000-0x00000000056FC000-memory.dmp

Filesize
624KB

Download
memory/4768-2-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/4768-30-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/4768-1-0x0000000000610000-0x0000000000BF2000-memory.dmp

Filesize
5.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads