gozi | 94c674c753209d3fd743df5a32b832aa55bf8a69e3a75f83f31571d4f36c667e

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b23d2c8dad85f174498a3df322b12df_JaffaCakes118.exe
Size

203KB
MD5

3b23d2c8dad85f174498a3df322b12df
SHA1

220877a9f890976aad3ed2e55b626881b755fd12
SHA256

94c674c753209d3fd743df5a32b832aa55bf8a69e3a75f83f31571d4f36c667e
SHA512

1b8d5df393c46a0ecf7d9899f6f0e778ec345606a41cf4c5259971ef73dd323c3dc3dc6901b355f60d46ba2b7a902277e29e5adec8164cbedff3b96672408780
SSDEEP

3072:9qji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:90dp4uPZzGonqXGXh0bluBc4GZ5

Score

10^/10

gozi 3162 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3162

menehleibe.com

liemuteste.com

thulligend.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d6ca5fd9f7425c4391773fa529781c9800000000020000000000106600000001000020000000b546887b14cffe242b5559f387eeb68ffdd68db7bda3b3c401e0b40e459a7a0b000000000e8000000002000020000000ea83a4ff69c2344cc7c2fbb12d97f03635957be5e4fce978eb34b8c6da8c0b7a90000000f51f430e26b2d6781b5d80eac6ff5cfe5b9d6a5427fe5770397657b2c3e1768e54ed31357e694cbb76d689d6f341537c054f878823f414ca948601a2a656dcb6caa21c69e2ab09bfac0be4c0b28a89f9450dbda0d253bfd4899d5a8428a4505443945fbe27da02cff101dad77059edd42d6e69e5548fbee7b48e0de4dae16589753570c5b02b43bbad0e98e8620895e240000000ddd17c7148c41e325d85ad76bb7e6fd9ee9efd8c44052069d389d91b61730c07bcfbc97fed26973be189a85ad100b3b2e18287ac06b6f9969fd224b7eba212b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a102608da4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d6ca5fd9f7425c4391773fa529781c9800000000020000000000106600000001000020000000a7d3879de39049367258991a09091ff5130f2fed7284d300bb5b0cc2162518a9000000000e8000000002000020000000e556c23eeb5db5dd1e5992c31110cc0d6854716481facd2d555b1284e5ba6b4120000000deeecb22216fa822d182dcfcf68a0fb80a5f34d6c3c91cb315a679671bc525bc40000000f5411432ed0f08619c1f2910dbcd7256f95f1a051ededc13cca73921966148d3aa80c5f996667928e741fc8b9d3662eecd069c9772e9f2766841131966a835be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B4D3571-1080-11EF-919D-C273E1627A77} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2676 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2676 iexplore.exe
2676 iexplore.exe
2760 IEXPLORE.EXE
2760 IEXPLORE.EXE

pid	process
2676	iexplore.exe

pid	process
2676	iexplore.exe
2676	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2676 wrote to memory of 2760	2676	iexplore.exe	IEXPLORE.EXE
PID 2676 wrote to memory of 2760	2676	iexplore.exe	IEXPLORE.EXE
PID 2676 wrote to memory of 2760	2676	iexplore.exe	IEXPLORE.EXE
PID 2676 wrote to memory of 2760	2676	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\3b23d2c8dad85f174498a3df322b12df_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b23d2c8dad85f174498a3df322b12df_JaffaCakes118.exe"
1⤵
PID:1884

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
596641279fe6c48c761183c1b3dda453

SHA1
7af98115dbab5b63693d8fcae76b084387473551

SHA256
e9340ec7c8027f689b004b4af3f72fc41d784a743a62f01fd25d82a2e9274523

SHA512
fc0da4c56709338e0309d37aa1dbae75eb4ed537c592cd619f22684e05b2f52affe26833a66c30e4df5729b02ad18f641cdd9df32dd0d7ecaa60f2bbbbff1dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
dff02172c5c95f960bb671fda010f1d7

SHA1
8771461869b47c0f156bb47d8c64ab448c0de199

SHA256
5326bfa29cfe09751cc23fa0ac3c8ef47c1da7bf120c29114aa6f37cfcd6b622

SHA512
a74db19b04dde8ef5e238e13569baf8c42a7760360bd7dac27a34ac7b1d383bd91069d0a5e140ca9c5c19e8db3003910163ae60a2e7276889bd0044513ba9a0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
a06e48f0761c79f3f28be6a93509d26c

SHA1
9adc8e417fe5e2887afee1d5cb4fda4fb8aafe1d

SHA256
37652eff09f76189009f1c8a0f9e615fdfeb4b0bec852a774a065162bd560e51

SHA512
a58e52c11677d3885f9edbc08f7c367a1a8e9b1d3471fd6b2d5e8c6e9698f1775ba762b7bb5887aae8ae018ef82e16486aea67b1f91e7c3057d5bc039de2863a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
6f402a13a3e70b336d5321f653b9bdc9

SHA1
8eaa9c449d79517e2fe070e9684a4bb15395d6fe

SHA256
eeffc1cc06d95b14ef14fe13e61b3333aa00be4600df65b665d7d4e4a72a0dd9

SHA512
3e6bc2d1059b3b86604b10b9a67f24560a0d2b0227ae634e370fe8ac3dc801cdc807caa1059ee0d4b9aa19263cc1fbb6b2dae8b8c69c26d9b337058de7178d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
1740b6020997aa1ebe0723a84428d2fd

SHA1
44dc10d2a407d7c3468228a6ea0448afa5728b66

SHA256
1fa62e63627160b503a31a4a90d29c66ae81eb6cbd9c5d20c9d872ab4896f1a3

SHA512
18ff5924f37eb35647e05b35371d2bb050f4af677553dacf906f0db47957e4871f0c918f247573ad363949ac82213bbb7c65261e327a55a3bc1fb21cce2439f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
b5abe668eff40820e84a894bce57fa78

SHA1
b040302f7c7033b7d26dcbfdad28ae87aa95c6cd

SHA256
cd9b3ce163c7b38f2a937f765aead3d43717acee334b548c64f3248cdd9cc5bf

SHA512
c10a02eec350c459e87c1d01177a0cfdfc48fb0a49c8a9817802ed72579fd971f9ccd23b7b33b976c08ce818c55c0b5c47207b672e09aeff9fa5e77a6f4bbfb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
2f4378d611f46100749a5217f5b3a9cc

SHA1
6f494e5531e5f3e9b5dbcdb26a83dfe2f2d0ad92

SHA256
d4ef3b5b93ac0448fdbdec291e3dcf5de9f6e1cc5ad37a052979a63da254ee1a

SHA512
f0bd9bc43eb815e926d33013eabf6857eff7e0d4d3ec75bb2745ff30720ef979f13da6f2ce6b4b517cb6da5778c247ca6a4e44e8ba60565a4cd9c2a48bfef659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
25b00d44f2884f392207ada075c53737

SHA1
0fb96c5e59cbbef7ff5b8f1778a9ad0d1e4a7feb

SHA256
cf652321bf1b2d1a60bf10526178d46bdc590192a45892543f57aefad7b7dbd3

SHA512
09cd01efc854d8eef25d7d666e0e1239ddabc2aad5e87cf8020ebe24eb39a9b8d3e4e3d4354b69b31316226b6f7b6dd2e79cee58b3416cd5e863506634e4a9ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
bebf4e0bcc0c6148ddadad284c14dee6

SHA1
360867bb73422a52f63e93b979b7ad8e7b75369a

SHA256
0176e0717df9a6f5db54df404aec509a98c092d7ddd7c2a6dd3e6602730e5fcf

SHA512
230ada2fc6f3636d3689b9f098e568378f41ddae392603b5e3244b7d4fb2d1d33551c88a4a82c4502f8abc4737874b4a70e0c4488ac250d81d74455f166e0202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
2364a3d09ba77d04193d4e03763119b4

SHA1
525fd178e3853debc0fe44581d66ea6ae37ecb97

SHA256
831faf69543acff3f2cf13b4211c9178f48261a4f7c9f2826e9d5ba6eac30c93

SHA512
9853b51d617d4e6ec4610401692333c7cf83ec706400ac3f9e706ebc933440dc28482fe76d40ffb0ad213dee04208389d1a05c7968b10a824eeff3af35a021c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
d89e05d85eaabd5b47c5e1dac2b9ef6b

SHA1
d64c9aa95a26ff53f5b5afacbc4a28c95d1480b8

SHA256
06331b440477b3c946ecb1e0850323e9f1901d0e398376800de742748a687229

SHA512
98db412a0bc3036349e7636a4781722ceaf7523b17adfa7c8377306b2961dd6f6faee93007fddfd8efe0997a54b79612cacdb5499085354454637f378d051e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar83D6.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/1884-8-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/1884-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1884-3-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1884-1-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1884-2-0x0000000000435000-0x000000000043A000-memory.dmp

Filesize
20KB

Download
memory/1884-4-0x0000000000290000-0x00000000002AB000-memory.dmp

Filesize
108KB

Download
memory/1884-13-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download