Overview

overview

10

Static

static

1

856c9d9c2b...18.exe

windows7-x64

10

856c9d9c2b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 00:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    856c9d9c2b9242cdf2628fff86c2ca36_JaffaCakes118.exe

  • Size

    619KB

  • MD5

    856c9d9c2b9242cdf2628fff86c2ca36

  • SHA1

    578b1e772213dc4a75b0a46dd741b696825ebcfc

  • SHA256

    2ed935e2467bc6328f823151f104f52abc3ad9de772e7a0623c9e370816cf6ba

  • SHA512

    bbba44363e6d77708eb67a336adc485868b7461d66eea1c1cbdad44947938830b8cb94d10abe3f6e5715d723732e5719710d0b12336e660fe98005d9bc2940e2

  • SSDEEP

    6144:ZFApUH6tEtEtEtEtEtEtEtEtEtEtzeMnMrvwgLdbxAfYAK7zf:2eeeeeeeeeezqrxLYfY9z

Score
10/10
gozi90020242bankerrm3trojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    300900

Extracted

Family

gozi

Botnet

90020242

C2

https://vrhgroups.xyz

Attributes
  • build

    300900

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SetWindowsHookEx 32 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\856c9d9c2b9242cdf2628fff86c2ca36_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\856c9d9c2b9242cdf2628fff86c2ca36_JaffaCakes118.exe"
    1⤵
      PID:4656
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:1640
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1028
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1028 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1816
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4036
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1848
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:17410 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:3468
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3712
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3712 CREDAT:17410 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4576
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:332
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:332 CREDAT:17410 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:3356
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4084
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4084 CREDAT:17410 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4560
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2636
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:17410 /prefetch:2
            2⤵
            • Suspicious use of SetWindowsHookEx
            PID:4772
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4388
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4388 CREDAT:17410 /prefetch:2
            2⤵
            • Suspicious use of SetWindowsHookEx
            PID:1764
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1396
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1396 CREDAT:17410 /prefetch:2
            2⤵
            • Suspicious use of SetWindowsHookEx
            PID:3340

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\httpErrorPagesScripts[1]
          Filesize

          11KB

          MD5

          9234071287e637f85d721463c488704c

          SHA1

          cca09b1e0fba38ba29d3972ed8dcecefdef8c152

          SHA256

          65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

          SHA512

          87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\errorPageStrings[1]
          Filesize

          4KB

          MD5

          d65ec06f21c379c87040b83cc1abac6b

          SHA1

          208d0a0bb775661758394be7e4afb18357e46c8b

          SHA256

          a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

          SHA512

          8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\dnserror[1]
          Filesize

          2KB

          MD5

          2dc61eb461da1436f5d22bce51425660

          SHA1

          e1b79bcab0f073868079d807faec669596dc46c1

          SHA256

          acdeb4966289b6ce46ecc879531f85e9c6f94b718aab521d38e2e00f7f7f7993

          SHA512

          a88becb4fbddc5afc55e4dc0135af714a3eec4a63810ae5a989f2cecb824a686165d3cedb8cbd8f35c7e5b9f4136c29dea32736aabb451fe8088b978b493ac6d

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\down[1]
          Filesize

          748B

          MD5

          c4f558c4c8b56858f15c09037cd6625a

          SHA1

          ee497cc061d6a7a59bb66defea65f9a8145ba240

          SHA256

          39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781

          SHA512

          d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\NewErrorPageTemplate[1]
          Filesize

          1KB

          MD5

          dfeabde84792228093a5a270352395b6

          SHA1

          e41258c9576721025926326f76063c2305586f76

          SHA256

          77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075

          SHA512

          e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\~DF710F3697FA925035.TMP
          Filesize

          16KB

          MD5

          6d29e0a064062bbe24ef4d0e610cba2d

          SHA1

          2ed83c3f4a8dd0e7cfe3833ac0cc84a6caf06d0e

          SHA256

          891ce635bc2bb4da90d06065057db835cccddb5d80ae9215b95e4cfbccf0fdce

          SHA512

          4f486760dc559d248806013e096649c03d2766612484a866dcfb9498375d13ab0215c09091162b5f50c67fefa4d93ecea53d6912419fe05651c37fd84154448d

          Download Submit

        • memory/4656-0-0x00000000021E0000-0x0000000002208000-memory.dmp

          Filesize

          160KB

          Download

        • memory/4656-1-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

          Download

        • memory/4656-2-0x0000000002240000-0x0000000002256000-memory.dmp

          Filesize

          88KB

          Download

        • memory/4656-8-0x0000000000400000-0x000000000049B000-memory.dmp

          Filesize

          620KB

          Download

        • memory/4656-17-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

          Download