gozi | 26eb4b1ea83a2b23fd8d8787bedec39b00d45aab6c3fad14eea002bb8a933855

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

759db4e2fd0ceabfdb760fc4a1b751af_JaffaCakes118.exe
Size

269KB
MD5

759db4e2fd0ceabfdb760fc4a1b751af
SHA1

371d6267a6fe7b4f8c0c5c64c7316805cf657c47
SHA256

26eb4b1ea83a2b23fd8d8787bedec39b00d45aab6c3fad14eea002bb8a933855
SHA512

43f27e67429284b95c0ca9b18c6f6c542d1cf33ed362b5fa4862fdda5afeb6a1955eac91629ee98f11f4d148820587a61055034335e35146d6a9b526b6d8f511
SSDEEP

6144:zVfmmDgASD5W/adCxsT4/YFqBcIsBGOhN/35:zVfjDmtW/adCC4/UIsBhN/5

Score

10^/10

gozi 3151 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3151

zardinglog.com

sycingshbo.com

imminesenc.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f088ed1b74afda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a1569deb8292024eb7d22c34937bcc39000000000200000000001066000000010000200000009e9acd5e70f8f59126445418a2f7155a3849e0ee119bfb436f3867e439dbcebf000000000e8000000002000020000000fee5164e05a31fb642c8e45f7851264e0fcd77d4361bd469294f46c95076091390000000853e296b4edad548027a53cfc303601c25e105739b0dda7a7f1678ae1afe6f56cf39c5b11ef52ce33538278634a81fdfc82bf4af13b8cdccaff10f1f27e1b760998ec33c160bfa81f8f3c7f5e3cf02f9463df3cb3f6364ef05c58a78258ce819b8bc3e74b0643e0f7df7e325333cafb0f7f99f95a98a3c0f4672c8e09a28a26e4e67e0004a656f8194b7e30fc53043804000000082a685e1620c93df7143e841245db469a0845b82365ba1fd24689f3e2a395d460328a4cf4af68b339038c5bf71d2d00fbc4f5b0235e00c9ed44fae4bed6da5c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{473CF771-1B67-11EF-A4DC-6EC9990C2B7A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a1569deb8292024eb7d22c34937bcc39000000000200000000001066000000010000200000003dfeaf8ebdbbacd13346519532916298aae8a040690fcb8fce3fc9724386f765000000000e80000000020000200000000e286861dd952edc1ae1fa1760511beebf9a99ef545fb925e7aceabcecdd69e8200000009980d77c931a44230c2fd1d0072e64fa11b3dd3b933ea5420f92115573bda938400000005fa37e78588dc69b57884673208447012e1322c1264c15e79956cd2be95c5d7f8627560801eb38ddd267245dd80975a1c802c93c202d31f0a2902edf2a209254	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2804 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2804 iexplore.exe
2804 iexplore.exe
2572 IEXPLORE.EXE
2572 IEXPLORE.EXE

pid	process
2804	iexplore.exe

pid	process
2804	iexplore.exe
2804	iexplore.exe
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2804 wrote to memory of 2572	2804	iexplore.exe	IEXPLORE.EXE
PID 2804 wrote to memory of 2572	2804	iexplore.exe	IEXPLORE.EXE
PID 2804 wrote to memory of 2572	2804	iexplore.exe	IEXPLORE.EXE
PID 2804 wrote to memory of 2572	2804	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\759db4e2fd0ceabfdb760fc4a1b751af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\759db4e2fd0ceabfdb760fc4a1b751af_JaffaCakes118.exe"
1⤵
PID:1776

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d258472c28f290dfee4a34d03b405f1

SHA1
ae714d62aaa7e64a25fea9ee34ca98686ff8e0fa

SHA256
48f5717f8138a48680d74064c826b49df891b02d24bf6d8a9cda2c9e2192bef9

SHA512
d189d0f8ad81177ec352286c8380aaed01e710f207f654d7c26c8bdd43e2d9e19947c1ad9782fabbcf3b34ec8b6bc2cfa3127ec5efe084523afb2b78b1ad4075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0be50e2e892ad1d173563f2eed04f93

SHA1
52a069032196dee3f5cbaf42557a16822cf1dedc

SHA256
a37da3671b2d2fd4987bf14d1385ea470eb072a6c4c5069babe76fdb237dd4f3

SHA512
f10ea3df30824e73cc9b84d7f6dbf34bede4304166d635fba718c1f565c58c19d6d4c22240259c00c6771c5022a4320e31a207d02a666877c551ce3d5f0e17b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed831ad425a06598c7e6e3e23a43e5de

SHA1
4006c0f3315f0c31245967909e5ec21460c57758

SHA256
aa9ed099dd473893876bd90251cd4921bb552feea378b2a249d1da2208595964

SHA512
aeb99e86269359c82adafef1d2f3ee6e6cb03e15eafcea45b34a2faa52b97e6fc50cc4146b09deb783483fa792d85d7d21fd83ee9e463734cd8046e407d82895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8715bbadcf4ca552a7728c317b4e50b

SHA1
91109f447c58c762b01889e25f17a580ec5ee785

SHA256
3c3c1cc2a6a93424d8c18eb59b7c54106504a89184392405314e0977771ff84a

SHA512
59126c370194d66b8e18e8a929cb4ed03c3c25abe5ec5c82d496336eb63d65004614f0e8f681d398f0f4274e6bf504d29943441fc7b131b7c8741b2386eb08f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8406dd150ecd2d028b87280326853ec2

SHA1
5f0eefe22381ca5890790b5d5ec1c31d53b31c1e

SHA256
714e2a0a17f24744aea60841fb9bd82250d8bdbaa0baee27a982f5a74d976400

SHA512
10e95f54c1a61859e7a09accdd12b2a314aa2f38f6e59b8e826a359205e6f1c710591ed9495f589d62b42544f389528f4823db0b5d1d8b7172cc45b9baeb0c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27c554d09e15e8c0259c6fc5402e6c67

SHA1
84c18b9b4c1ad690aa322807d7d17d853e185751

SHA256
6ae0ecae962ba93a02aa2eec5db08cdf47eff308dbb209aab2f4f2b24b4181bf

SHA512
0b2070e279728dd7a7e67a48130a9b45d61d763de81bb8dd1cb62f7dd4411bafe9ba759ec1c9ba88f777da67202fdc801895e484a2f7201adc7d1335bcab8110

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91502070f9fd680f2e1918cf5a62fba9

SHA1
dc17346c539f6bd0582bb8733a86868196de1e5e

SHA256
4e909afea62ec2185965e9a77a24591a76ac9e63ea844c2da0565575b7bca90b

SHA512
559c55d7286e07a3b8b0383795e2007847428e7cbb0223707ff0f6a5d11b0d162dcb20b57aec7c1746a30812fff1e27869c6751ed532b83e0cde2ffa9a9efb59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d27feae84179a2980aa6443c60d7984

SHA1
84b638d5539d046facf91775fc6e11ae5c72d618

SHA256
93ced94a79f985ce3f2714f4568e02375eaf29a8dd89359a07c804d06ebd6083

SHA512
159c4a0e6772705b71d403c7fd46ae409d218a24b3adcab1e24e9bf4cb796d3c4772d57821fddc188eaf6a1bf071a519ca09b7ed78775c6b834e03269b375533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
654fc1f28d805cd7985b90c24c7beaca

SHA1
6a4ee6bd56fb0dec67bf206b7d4f8dca77f0e7c6

SHA256
96399b6427753d28f5c35f608e589d4720d519496293d38edfd49021daeacd8a

SHA512
b72ed1c359f836ca896da70e502206bd275315b429255a4e21d96002d65b560ae6f3c7a6a77a5e101cf01d4d90eacb23193cb8ceec6021571300a55f0c389898

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab86AF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8791.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/1776-0-0x00000000013E0000-0x0000000001433000-memory.dmp

Filesize
332KB

Download
memory/1776-6-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/1776-2-0x0000000000270000-0x000000000028B000-memory.dmp

Filesize
108KB

Download
memory/1776-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download