gozi | 0fdbe7bcafa2968e63429361502bd3a78fb4efe8d7e40421990b025aadd42f3a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01b47c599033cc101df4762ea2c092f1_JaffaCakes118.exe
Size

203KB
MD5

01b47c599033cc101df4762ea2c092f1
SHA1

e488b358fa2137ef6acfe7676bca9ac292eefd3d
SHA256

0fdbe7bcafa2968e63429361502bd3a78fb4efe8d7e40421990b025aadd42f3a
SHA512

f5bccc2fd4b61b13dfc06803ebd8ddbee9e9359e99fccce9cb44b4774851f65127d9717180ac9d7fe366d635f82c39eaf447579150dec740d7991610591befbf
SSDEEP

3072:9gji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:96dp4uPZzGonqXGXh0bluBc4GZ5

Score

10^/10

gozi 3162 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3162

menehleibe.com

liemuteste.com

thulligend.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000bbc6a5d679d4d80f4776c3ce79f9ea36c092c7c41e3914289fce6e058fc5b1e5000000000e800000000200002000000095750d34070743f4626c01d89a87080bdd2478a3bd8b09112ce4d6c46cd3ffb520000000a443b36c072362994e287f35567579ca57eaed15398cb4e3a0a75ae596fb0d2940000000b3b3e80ef366ebb8bc7c1bafbec9d7990eb34911b9b63f6f21335f16f5c6428000b1523c0d50c3224ebc85bd7387975f51562a79eee9b7db29a6bfb4b2b05d88	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0bef1062198da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000573ff83a7dc1b5abef93c615aa191316aff1870b2749a941a2553e3c19074e06000000000e80000000020000200000006fe2611eff33f7445172c326dedd8f90e2900a2e559502c790384a2e1dc99fcb90000000ad7115ae29ab41dbade545d50a597ae766056374e6fad63953742f656ee5f12c087533bb533026152da8a012e8dc9bdbc65ce5104edbbb004abc80ead495f153659512fffc361c78aebee4d5942711d6d4f0b02edafae640cc6766f58a172e99754abc109eee8e4076ccb350f51cc3210fd155be0194c2cd81db6dade8b065a5fcc545b39e62f26f4b5f30bc1a9bc66840000000fe4d7ac1845c689a94948eababf1ab91666a9e99ac4f2ebee83745f061ef451e726364dfc0a9cdaa5c673ef40f7a946d4712274267b2ea66e0e163438aaa62c2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{322E0321-0414-11EF-BF93-66356D7B1278} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2808 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2808 iexplore.exe
2808 iexplore.exe
2428 IEXPLORE.EXE
2428 IEXPLORE.EXE

pid	process
2808	iexplore.exe

pid	process
2808	iexplore.exe
2808	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2808 wrote to memory of 2428	2808	iexplore.exe	IEXPLORE.EXE
PID 2808 wrote to memory of 2428	2808	iexplore.exe	IEXPLORE.EXE
PID 2808 wrote to memory of 2428	2808	iexplore.exe	IEXPLORE.EXE
PID 2808 wrote to memory of 2428	2808	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\01b47c599033cc101df4762ea2c092f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01b47c599033cc101df4762ea2c092f1_JaffaCakes118.exe"
1⤵
PID:2040

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2428

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0c7bdc1b16fb9a010feda43d425dafe6

SHA1
3e530da1d6d60674e8e5f85046a76a144d02448f

SHA256
b2c0d98d0b4b199c5e17d8c5966c43a9f57c5d8841297cf3b05d14fd62752aba

SHA512
e9a0f26da3b6fd9ce127762796354ce9ef5a062a7bd603cf000533c6b8d15463db9c0212224eb6705d432854ee6f27a6e89cda59afe55aac64ce17516eb779c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
339e090a7710c8812a885e241ecbcb29

SHA1
133a8dd01e55812ef552d7eaead2bfc66acbefc0

SHA256
fb2a1bd2ce615070d16ea0eb813eab9e1f4e5923841dfcc1746b2599c2f6be6e

SHA512
9476c954e1a91002735786bfca557cda9ab5e9243c8d5a9e7ffa329dfb75d594635db032623b86fa3faa56f666d5a83d737f8985294a079c6c6d9aaa5698b3f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2f55e1785a0e7dd4782be61b4b6ba7d2

SHA1
b4feed2423ae5acd2b6b72f13dfd643adc5ca4e4

SHA256
111f9bef0496e00b84177f6c2b94fb7306dffafb9df498ed2264812f8c9b549d

SHA512
69acbc9fd3d32f535ef2a8b4c32ff637256f0e98765210fd3a6f973d0e530bf43a92a9aaa5cc41ca5441f36f50a4d6d3e8c2856da9b675bc6c1a4ad302560300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bbfb4d2a571a8b31f127772d797a939f

SHA1
e54f9da71a5331a4b302a54bfdf760f3117e9e36

SHA256
a6401d842c5c8e64090f463fde3484667d2e27defd1f19016e84a0dc662c5111

SHA512
32603939083de73c3427f2bc1060d3bb42d37ce766a4fa33499b034da4355a7374986a0dc8ed390047c6bd44cc25d18c90c78b2426f921e286b082d8c175936d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d81e734b8b508520ba9556294be0c2ec

SHA1
bef32558d24b8b32034c65fafbe0d54a6083f941

SHA256
736bde6a7b283b3a6e369ceeda69a4652a1c8a311cde6c4992bf49b34d29eef4

SHA512
e37ebaf6faa398f70260db4ca7018c6d203754d16023c34418107e09fbca30c0135b60d5b179513c5e050bac98f9f94c95d4e458d982ca405a6fd75b3b30cace

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1610085ef10b152cb47c311cc2039131

SHA1
a23e34af12c3bbe38ba3dfc6bc415132609c206f

SHA256
90c6e70359b699d5d2ff6dc199151cd79a4169a7376484ff3f58c8ffc4a6096d

SHA512
b24754c66ad9e92ada0f1e50bead6953a2ff571576df10df7928208cd2d386120c39f5ec34ed5c5b394292e132ca0a56364f7323546e1ac81d07de3f194dbef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
be7282352935becac2abe618fc50f580

SHA1
9949be7aea05e282df394e01c2c0a5234e2722bb

SHA256
68f85df445a4c3803e066ba6814d0abe1c97c86178b602525c5f5dd6df9208b4

SHA512
5fb2c01aa808f37697a08bd1492d59113ee039d116a3230cd648e3834fc125b5310e48c7d995dc1b5b6cbea8e28092a023e33252e5ace8522d097c524ffaef20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2b1f9d795a601c915d79cfbd025393f4

SHA1
a10cf83804afb60bfe1c65808887d5f929cb518a

SHA256
5510b82cf11cea61207f74e2f2571246396d4a30dad47e28cf870c188b762862

SHA512
2afc93808a682f2a29e7a86a1f4c503be4f365668532c5ec2596ad93d851c6454f0f81e61050c8662f2c80c811cabff5645db96114e03da816fff94e790d23d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
072acb4b9dafbf8efee182a22481b003

SHA1
5eadf5d06e62686f881cd171042d1604db0f385f

SHA256
5bda7165b2b8537637f5353095c907eea06f9e226ec50dd0501c3695084b6365

SHA512
2772af92232b99fd18bd0bbde47f5387e322ff5e5e0caa71415d5535a5dc2159346dbcdce6b591d65ec06af0faf452833e315a4934abc0131551b27b54fcf25f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8410.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8411.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar863A.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/2040-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2040-13-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2040-8-0x0000000000320000-0x0000000000322000-memory.dmp

Filesize
8KB

Download
memory/2040-4-0x0000000000300000-0x000000000031B000-memory.dmp

Filesize
108KB

Download
memory/2040-2-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2040-3-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2040-1-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download