gozi | 14b1331b4b21204d6309abc3dca90611007c56c46f3ca8bcfef310aaee1df954

General

Target
21f62543d610d509da5a21f96a603e33_JaffaCakes118.exe
Size 269KB
Sample240507-175essdf36
SHA256 14b1331b4b21204d6309abc3dca90611007c56c46f3ca8bcfef310aaee1df954
MD5 21f62543d610d509da5a21f96a603e33
SHA1 f6f0f964705da07bfee84aed89d66d964aa4b979
SHA512 8089a1ca11c79a659284eab99037cf2703993f5b9a6a27dbdf75533184724e66ec9044b5c47db64b0f9c82385b955730f5b01c61ca234b866197480c1d32459f
SSDEEP 6144:1VfmmDgASD5W/adCxsT4/YFqBcIsBGOhN/35:1VfjDmtW/adCC4/UIsBhN/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi 3151 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3151

C2

zardinglog.com
sycingshbo.com
imminesenc.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000489ac69b0132124fb8de8962fdfc14d000000000020000000000106600000001000020000000bf713e6be285ed06cd8837672aa3332a96124045b4989f5ba9a11d4345e4bdc6000000000e800000000200002000000084b2535469bde64144375a81b23be4b220fcc1972d39690b3983cf963977f8ef200000005476da9bac1b5a8366b2eda49a7916b44398eb07833246bd8b2463325a22e53a40000000f1390aa485d5fb87a07d2c357c5e4e7a99bb5e71098ebaae25044b7190eae0d13c019de9cee1b2b8553cede786b0775e3b8a8d2c66a083eccb9f1629353d7324	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ed719ecca0da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000489ac69b0132124fb8de8962fdfc14d000000000020000000000106600000001000020000000c7de2fed5a286d0f93831fa415bd2090d26b09a593c6725693746e959a15a9cd000000000e80000000020000200000009a80cd4ec426d1e99e3f4da11871c8243d3560528845cd41451709e4c93e860b2000000099ac67df92585697dcf81453b83838b0466c2df0cec64f66e7fab2250e2edcb240000000a8d06cd890e4b23691f2501ab39301d653a30459d0a35d199c7ce90a1431c85e7c682c29f9eafce7a84f067750e02635ac3156262e5e7e670be3b8b31272415f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0326d9ecca0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C95A60E6-0CBF-11EF-96EC-EE978EACE73F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4108	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4108	iexplore.exe
4108	iexplore.exe
3480	IEXPLORE.EXE
3480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 3480	4108	iexplore.exe	99
PID 4108 wrote to memory of 3480	4108	iexplore.exe	99
PID 4108 wrote to memory of 3480	4108	iexplore.exe	99

C:\Users\Admin\AppData\Local\Temp\21f62543d610d509da5a21f96a603e33_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21f62543d610d509da5a21f96a603e33_JaffaCakes118.exe"
1⤵
PID:112

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:544

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4108 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-0-0x0000000001000000-0x0000000001053000-memory.dmp

Download

memory/112-1-0x0000000001250000-0x0000000001251000-memory.dmp

Download

memory/112-2-0x0000000001390000-0x00000000013AB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads