Overview

overview

10

Static

static

3

5016784605...18.dll

windows7-x64

10

5016784605...18.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-05-2024 14:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5016784605ad3fd883fbdfdd5fbd469f_JaffaCakes118.dll

  • Size

    749KB

  • MD5

    5016784605ad3fd883fbdfdd5fbd469f

  • SHA1

    30100663d3d88d7399948f7f92602efcb70b5a86

  • SHA256

    14d4db1adde49001f81cb670a60f9d40fc7dea4b96cd77029ca87b44ccb586c8

  • SHA512

    3f61dac201d25c5cb8932e9bed8b762c6897462edf912091e6921f2895645908b64c91a779f8db0cac76a0ddae19808d9ba6ce7fb27cd0a0153c5bf20d01f116

  • SSDEEP

    12288:INVtF21kgh6j10JGCDn3NVEoYFA5rId7ipJC:INVtEjcMfTpYC5cmHC

Score
10/10
gozi700bankerisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

700

C2

http://cxzko43pnr7ujnte.onion

http://intraders-support.at

http://freshness-girls.at
Attributes
  • build

    216098

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\5016784605ad3fd883fbdfdd5fbd469f_JaffaCakes118.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4952
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\5016784605ad3fd883fbdfdd5fbd469f_JaffaCakes118.dll,#1
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4384
        • C:\Windows\system32\control.exe
          C:\Windows\system32\control.exe /?
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1444
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?
            5⤵
              PID:1988
      • C:\Windows\system32\cmd.exe
        cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\8059.bi1"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:540
        • C:\Windows\system32\nslookup.exe
          nslookup myip.opendns.com resolver1.opendns.com
          3⤵
            PID:3380
        • C:\Windows\system32\cmd.exe
          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8059.bi1"
          2⤵
            PID:5048
          • C:\Windows\syswow64\cmd.exe
            "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
            2⤵
              PID:2120
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4024
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            1⤵
              PID:3552
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              1⤵
                PID:4496
              • C:\Windows\System32\RuntimeBroker.exe
                C:\Windows\System32\RuntimeBroker.exe -Embedding
                1⤵
                  PID:3788
                • C:\Windows\System32\RuntimeBroker.exe
                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                  1⤵
                  • Modifies registry class
                  PID:2320

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\8059.bi1
                  Filesize

                  122B

                  MD5

                  86ae6b510c19228190f4b797503ce192

                  SHA1

                  0a6c67bc4f36fcdaa7a553f9ff9ae439f13b32d1

                  SHA256

                  be8c30a0e245b6d86db1e7bdf04b8cfa3117846d5b88f6d476066041eaea1c3a

                  SHA512

                  bec76ed958ccf192f26b2eb9250f02ce2cf04318cc4f51d30cbbd24b96de172f4f26bbac018938ebd2f7c38f70e70def8d8f6b0e9b473b3a32bbe252449e3dd5

                  Download Submit
                • C:\Users\Admin\AppData\Roaming\Microsoft\Authbi\dinptils.dll
                  Filesize

                  749KB

                  MD5

                  5016784605ad3fd883fbdfdd5fbd469f

                  SHA1

                  30100663d3d88d7399948f7f92602efcb70b5a86

                  SHA256

                  14d4db1adde49001f81cb670a60f9d40fc7dea4b96cd77029ca87b44ccb586c8

                  SHA512

                  3f61dac201d25c5cb8932e9bed8b762c6897462edf912091e6921f2895645908b64c91a779f8db0cac76a0ddae19808d9ba6ce7fb27cd0a0153c5bf20d01f116

                  Download Submit
                • memory/1444-16-0x0000000000B00000-0x0000000000BB3000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/1444-58-0x0000000000B00000-0x0000000000BB3000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/1444-21-0x0000000000BC0000-0x0000000000BC1000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/1444-22-0x0000000000B00000-0x0000000000BB3000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/1988-46-0x0000015562560000-0x0000015562613000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/2120-69-0x00000000011D0000-0x0000000001275000-memory.dmp
                  Filesize

                  660KB

                  Download
                • memory/2320-59-0x000001CF53500000-0x000001CF535B3000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/3540-63-0x0000000002DA0000-0x0000000002E53000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/3540-25-0x0000000002DA0000-0x0000000002E53000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/3540-31-0x0000000000B10000-0x0000000000B11000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/3540-32-0x0000000002DA0000-0x0000000002E53000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/3552-39-0x0000029953190000-0x0000029953243000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/3552-44-0x0000029953190000-0x0000029953243000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/3552-43-0x0000029953150000-0x0000029953151000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/3788-54-0x00000183075B0000-0x0000018307663000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/4024-37-0x0000029C56C70000-0x0000029C56C71000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4024-38-0x0000029C56BB0000-0x0000029C56C63000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/4024-33-0x0000029C56BB0000-0x0000029C56C63000-memory.dmp
                  Filesize

                  716KB

                  Download
                • memory/4384-1-0x00000000746F0000-0x00000000750BD000-memory.dmp
                  Filesize

                  9.8MB

                  Download
                • memory/4384-13-0x00000000029E0000-0x0000000002A2A000-memory.dmp
                  Filesize

                  296KB

                  Download
                • memory/4384-0-0x00000000746F0000-0x00000000750BD000-memory.dmp
                  Filesize

                  9.8MB

                  Download
                • memory/4384-3-0x00000000746F0000-0x00000000750BD000-memory.dmp
                  Filesize

                  9.8MB

                  Download
                • memory/4384-24-0x00000000746F0000-0x00000000750BD000-memory.dmp
                  Filesize

                  9.8MB

                  Download
                • memory/4384-2-0x00000000747AB000-0x00000000747B0000-memory.dmp
                  Filesize

                  20KB

                  Download
                • memory/4384-6-0x00000000029E0000-0x0000000002A2A000-memory.dmp
                  Filesize

                  296KB

                  Download
                • memory/4496-50-0x00000204A8CC0000-0x00000204A8D73000-memory.dmp
                  Filesize

                  716KB

                  Download