Analysis

  • max time kernel
    129s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 19:21

General

  • Target

    INJV2.exe

  • Size

    12KB

  • MD5

    f919eff1df3e3bc2894a77a603a1c12e

  • SHA1

    aeba53afc8a9d3c9766e967b9b85adfdba0aa4b5

  • SHA256

    aa4ee47c8ab931a02915fbede23a34ac01e653d9e64da989e7c59e4226a69f06

  • SHA512

    b3b5e23e0b4a6b583a0e03403739572da7f12b6270970b749114924251191cde83e1c711461b39081117e4bfb343505ab57247f1a918564cde646f50375718ba

  • SSDEEP

    192:mBZ+wmRp6Z4g42uX/z47EPvlYLxQt+9k1YbAsVV+0h8J1keM:mBqEN/c/zkJLWQoYtv++N

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3556
    • C:\Users\Admin\AppData\Local\Temp\INJV2.exe
      "C:\Users\Admin\AppData\Local\Temp\INJV2.exe"
      2⤵
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\damagehit2754547.vbs" /f
        3⤵
        • Modifies registry class
        PID:3060
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
        3⤵
        • Modifies registry class
        PID:3548
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C computerdefaults.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          computerdefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3088
          • C:\Windows\SysWOW64\wscript.exe
            "wscript.exe" C:\Users\Admin\AppData\Local\Temp\damagehit2754547.vbs
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:1360
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
              6⤵
                PID:876
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN iTunesUpdateTask_JgKPzgmrZu1ekI1dj050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\JgKPzgmrZu1ekI1dj050MX.exe" /RL HIGHEST /IT
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3240
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /SC ONLOGON /TN iTunesUpdateTask_JgKPzgmrZu1ekI1dj050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\JgKPzgmrZu1ekI1dj050MX.exe" /RL HIGHEST /IT
            4⤵
            • Creates scheduled task(s)
            PID:3896
        • C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe
          "C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe" explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3796
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4928

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\4378fface2a64ebe8d117999a074b066

        Filesize

        255KB

        MD5

        ada6fc392b78f818885a5a7e02159f2c

        SHA1

        e7d7293dad57b7e070a46f45e9c18433e986c5e6

        SHA256

        9562d4ca59820a117742b81f1304a29f9884d9ce7ceee217078eb15e2e4e6a91

        SHA512

        051723e9631599e8c475d89b3ac778a805e9bd4e312f432783be5c4081913240e4a7e97b2402aacf7a389691568d83994da638d39d5b800d0df4279a711af1f9

      • C:\Users\Admin\AppData\Local\Temp\48519d200a15444ea265fcb9fa023406

        Filesize

        46KB

        MD5

        8f5942354d3809f865f9767eddf51314

        SHA1

        20be11c0d42fc0cef53931ea9152b55082d1a11e

        SHA256

        776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

        SHA512

        fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

      • C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll

        Filesize

        1.4MB

        MD5

        6f2fdecc48e7d72ca1eb7f17a97e59ad

        SHA1

        fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

        SHA256

        70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

        SHA512

        fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

      • C:\Users\Admin\AppData\Local\Temp\damagehit2754547.vbs

        Filesize

        171B

        MD5

        a34267102c21aff46aecc85598924544

        SHA1

        77268af47c6a4b9c6be7f7487b2c9b233d49d435

        SHA256

        eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44

        SHA512

        5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

      • C:\Users\Admin\AppData\Local\Temp\ddda122cf4254b80a7bc45ecadede139

        Filesize

        8KB

        MD5

        bde34615ab4dce41e3e02f91b4ff5299

        SHA1

        e48db653d9713109f0474f2f2af6d51bfc92b5dd

        SHA256

        355497a6678723c417e611763b88872d5ed2d41a5496ffdf9ef33ca4f4a94f54

        SHA512

        fdb92f3b9858e38db404a6e1d91fd5f28c517b06c391d62eaeef44c7b7265e89b34565d66c3fc430143994e038abaf96c09fc46f798caa9cd8ea5b99cac38819

      • C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe

        Filesize

        124KB

        MD5

        e898826598a138f86f2aa80c0830707a

        SHA1

        1e912a5671f7786cc077f83146a0484e5a78729c

        SHA256

        df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a

        SHA512

        6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb

      • C:\Users\Admin\AppData\Roaming\Gongle\a95AFHP852\CURRENT

        Filesize

        16B

        MD5

        46295cac801e5d4857d09837238a6394

        SHA1

        44e0fa1b517dbf802b18faf0785eeea6ac51594b

        SHA256

        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

        SHA512

        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

      • C:\Users\Admin\AppData\Roaming\Gongle\a95AFHP852\LOG

        Filesize

        329B

        MD5

        ed2c6891f9298b4485b39bba0b59bfd6

        SHA1

        0993bd50b5991c4adbc2d1a29a0785fb9fbb293e

        SHA256

        ad93f92bb36b976dab155e195944a48705f44645b98ecb67b26fd1fa7077b262

        SHA512

        58fe343a125f7e604a095cf02dbab191bc497ab559bb9e42691653a45282ef85145ff14929a9ff209a95ee67add03ce4ab081a3b4dc6db15fd429774d12d49c5

      • C:\Users\Admin\AppData\Roaming\Gongle\a95AFHP852\LOG.old

        Filesize

        291B

        MD5

        921ff2050928372f6f2d9af17bb08d36

        SHA1

        31e0561115475c84db1e1ac5a141b77557c8e4a1

        SHA256

        9c5c47feae436e236c38c5d0f939fd358be000daf523e87bb930c836ed2423ca

        SHA512

        e8681309d3a8681ee51e5686dd4d014785f1e2309ed735c1657dce2742291ef9aef8f280dad8e47ab6128d61acd474dbbec8e7b4d1cdfe7a6d395d5445528372

      • C:\Users\Admin\AppData\Roaming\Gongle\a95AFHP852\MANIFEST-000001

        Filesize

        41B

        MD5

        5af87dfd673ba2115e2fcf5cfdb727ab

        SHA1

        d5b5bbf396dc291274584ef71f444f420b6056f1

        SHA256

        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

        SHA512

        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

      • C:\Users\Admin\AppData\Roaming\Gongle\a9JK27MTM8\afevplna.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

        Filesize

        48KB

        MD5

        d3211993a87fb182e9b56e82acb5549c

        SHA1

        9136c9ad046d538d9cd524ad27f9935779516831

        SHA256

        a5442e3c9f120b581869e14b75a86c9f8257127326ee011e963bae0703103ad0

        SHA512

        6fb761177c3575f8b3885693f72bd7959781cd8767e909d76145edc1737fe07f953a563a300700cc18c779ee059328d1c9dd17af744f40cac4690aaf176cf7fb

      • C:\Users\Admin\AppData\Roaming\Gongle\aZM48ZZKV9\LOG

        Filesize

        331B

        MD5

        ec9bcbe3608f7a34909581ab9a069c6e

        SHA1

        e523c07f6d30cb7c49b6d98da352d065812fcbe5

        SHA256

        0765fedbadcd9cd8a1f386ecb7cdd1e6e1055b429232624167e06700a6cfb7c0

        SHA512

        763969be02de6a7b1384509a5a70bfa33b416341167f493a422189edc3649d3be2838691dad67c4bb5db6a6684349e01b7e73e97609be643fecc80466df9ee08

      • C:\Users\Admin\AppData\Roaming\Gongle\aZM48ZZKV9\LOG.old

        Filesize

        293B

        MD5

        35a59bf5f84a92ffacf1424219da9740

        SHA1

        e2e3b2af6a2e6c8fc0e9eb56e746f6398f67b07d

        SHA256

        b0840212236bd08136388c31b3dd00b7cb4962500a706585953f3c1d3ec21369

        SHA512

        0cd80a11187d7e94ea4c3d581909e633ba7636e91792f5b03f84980f34f97cce0018b8c99420870c8503a94f5a6448250ebbf343bf602171b8b535410731182e

      • memory/1196-42-0x000000000A910000-0x000000000A91A000-memory.dmp

        Filesize

        40KB

      • memory/1196-5-0x0000000005260000-0x0000000005804000-memory.dmp

        Filesize

        5.6MB

      • memory/1196-1-0x0000000000530000-0x000000000053C000-memory.dmp

        Filesize

        48KB

      • memory/1196-201-0x00000000071E0000-0x00000000071EA000-memory.dmp

        Filesize

        40KB

      • memory/1196-37-0x00000000075A0000-0x00000000075B2000-memory.dmp

        Filesize

        72KB

      • memory/1196-38-0x000000007440E000-0x000000007440F000-memory.dmp

        Filesize

        4KB

      • memory/1196-39-0x0000000074400000-0x0000000074BB0000-memory.dmp

        Filesize

        7.7MB

      • memory/1196-40-0x0000000007F50000-0x0000000007FB6000-memory.dmp

        Filesize

        408KB

      • memory/1196-41-0x0000000008080000-0x000000000808A000-memory.dmp

        Filesize

        40KB

      • memory/1196-0-0x000000007440E000-0x000000007440F000-memory.dmp

        Filesize

        4KB

      • memory/1196-43-0x000000000A930000-0x000000000A93C000-memory.dmp

        Filesize

        48KB

      • memory/1196-44-0x000000000CC50000-0x000000000CC58000-memory.dmp

        Filesize

        32KB

      • memory/1196-2-0x0000000000AC0000-0x0000000000ADA000-memory.dmp

        Filesize

        104KB

      • memory/1196-3-0x0000000000A10000-0x0000000000A1A000-memory.dmp

        Filesize

        40KB

      • memory/1196-11-0x00000000116E0000-0x0000000012382000-memory.dmp

        Filesize

        12.6MB

      • memory/1196-10-0x000000000A950000-0x000000000B550000-memory.dmp

        Filesize

        12.0MB

      • memory/1196-6-0x0000000074400000-0x0000000074BB0000-memory.dmp

        Filesize

        7.7MB

      • memory/1196-185-0x0000000007150000-0x000000000718C000-memory.dmp

        Filesize

        240KB

      • memory/1196-172-0x000000000CC60000-0x000000000CD12000-memory.dmp

        Filesize

        712KB

      • memory/1196-173-0x000000000CD10000-0x000000000CD32000-memory.dmp

        Filesize

        136KB

      • memory/1196-174-0x000000000CDC0000-0x000000000CE36000-memory.dmp

        Filesize

        472KB

      • memory/1196-175-0x000000000CD60000-0x000000000CD7E000-memory.dmp

        Filesize

        120KB

      • memory/1196-4-0x0000000004B80000-0x0000000004C12000-memory.dmp

        Filesize

        584KB

      • memory/1196-178-0x000000000CE90000-0x000000000CEE0000-memory.dmp

        Filesize

        320KB

      • memory/1196-179-0x00000000063D0000-0x000000000643A000-memory.dmp

        Filesize

        424KB

      • memory/1196-180-0x000000000CEE0000-0x000000000D234000-memory.dmp

        Filesize

        3.3MB

      • memory/1196-181-0x00000000064A0000-0x00000000064EC000-memory.dmp

        Filesize

        304KB

      • memory/1196-186-0x0000000007110000-0x0000000007131000-memory.dmp

        Filesize

        132KB

      • memory/3556-28-0x0000000000B30000-0x0000000000B38000-memory.dmp

        Filesize

        32KB

      • memory/3556-26-0x0000000000B30000-0x0000000000B38000-memory.dmp

        Filesize

        32KB

      • memory/3556-27-0x0000000000B60000-0x0000000000B61000-memory.dmp

        Filesize

        4KB

      • memory/3556-31-0x0000000000B30000-0x0000000000B38000-memory.dmp

        Filesize

        32KB

      • memory/3556-30-0x0000000000B30000-0x0000000000B38000-memory.dmp

        Filesize

        32KB