gozi | d26cd24ee90c08656cd738839b7357f4f88c85c70abfc3d0ca672e490e8113c6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8b440ec34faf1c02c01591e42ba8cfb_JaffaCakes118.exe
Size

269KB
MD5

a8b440ec34faf1c02c01591e42ba8cfb
SHA1

c1c7b2aaa4bb159ebfd7a80f175dc6bd40c95526
SHA256

d26cd24ee90c08656cd738839b7357f4f88c85c70abfc3d0ca672e490e8113c6
SHA512

e4fbf015049182600a6b7983b470ba97ed8772a4a181ee28c1e50281d17b0c6a019d4b6ee63f10787e652acf6287775d27d965dfb2df978d628c31f51c4be2d2
SSDEEP

6144:PVfmmDgASD5W/adCxsT4/YFqBcIsBGOhN/35:PVfjDmtW/adCC4/UIsBhN/5

Score

10^/10

gozi 3151 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
215165

Extracted

Family

gozi

Botnet

3151

zardinglog.com

sycingshbo.com

imminesenc.com

Attributes

build
215165
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000859032be26e52e4dabb78eaa840855fa00000000020000000000106600000001000020000000c3529ad2a6e09da8af48567a3f619ffc836e82227e89fd09f19642654e306441000000000e8000000002000020000000e99c03cdb02c48c2fa0d0c88b2d58f86d4dc24a1ec852c60882f57e5fba232c7200000000a22981bc2d1516bb24cb091029d31d95e336d7e4cd2857cc7f86cb697f57a9240000000cf04bb34b3cd51af2a900ce9dc0a7415b52d0ac4c75656fb625a067cb13c897c1f2f3435354066f824dc3fd94cce2f138700c39d19c5d544c6249b30449837f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000859032be26e52e4dabb78eaa840855fa000000000200000000001066000000010000200000002ac9c1e0ef437959b7854026287d07da848ecb4527abf71bce15b9174a797c4f000000000e8000000002000020000000874923f71b5905e33f1032304f114911e5c4f3306da1a0b6a194c4794decbf67900000006d5183d1af09f36542b24903bccbd12fad5b60709fb12b35c8b282a76872acda2b4837690c4fe34b53d5bc73d00c0516a7890cd749c1eda57b18301b26c5d786ef6c34079e4d9b409212986f5d710a18c28ca637e78b7631b7f5f3bec5fd99dbc499bcbe7ddce720d3321c3fb3b2eb0428b3af1758c8e3cb4813da7ca0923f777f21a72c0da15390f3daf2a28250bc4f40000000c9f6399254ce3ddb6d9abf4bc6ba0c8ecf4365a3db6dac39000b317c23b8cb31e3cf1f9bc80e3c0b6a0ceb27ca17f0e195929b52285f55342d4a2cac1c4cfa4b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB067701-2A26-11EF-9E06-5628A0CAC84B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0083adbf33beda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2660 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2660 iexplore.exe
2660 iexplore.exe
2484 IEXPLORE.EXE
2484 IEXPLORE.EXE

pid	process
2660	iexplore.exe

pid	process
2660	iexplore.exe
2660	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2660 wrote to memory of 2484	2660	iexplore.exe	IEXPLORE.EXE
PID 2660 wrote to memory of 2484	2660	iexplore.exe	IEXPLORE.EXE
PID 2660 wrote to memory of 2484	2660	iexplore.exe	IEXPLORE.EXE
PID 2660 wrote to memory of 2484	2660	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\a8b440ec34faf1c02c01591e42ba8cfb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a8b440ec34faf1c02c01591e42ba8cfb_JaffaCakes118.exe"
1⤵
PID:2200

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
06b122225e3544e3d9c483b2d6cf3ac6

SHA1
2aca0e83859996d1f24fba03a40d9aa7e308cca7

SHA256
dd08978d0c2c24c35d008a9c98b5151178afa03ab163adc534bcd339dcd6fdd3

SHA512
ced688b0c8d0fbe44c0628e01560ab454d4223478b10985a01108d8c1995fc8179dcfc692b2c387182d5ac6dc088e9482f52a9ebd9140d78f0e1a459f24606cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d7f1fbd6e477cd7229a8da6de772c7e9

SHA1
3655d64a030cfb88b921f2ce60151a090be5e4de

SHA256
6cd529d50a564fd3cfe260e4a3dbdf6f3516086dcc89a1655309433f2e05b16f

SHA512
dc49ed2963bf50a0ff944b36b9ca9073a109d667f8693676ea3805b2b82fa6f1f5e07f088e6242c852bd0853c2bd1ded3eddc9ced4b97f10bb9aa6ea4378d43d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
76ce19b531ec5f9caebf157d9fcd392e

SHA1
7d9e0a8a60a4293ae36e32b6c04e37289f2f2639

SHA256
4f73b57e4d458ef088cf4486a917f6e6e089b7d67e8ab513fd52002a66ecdd9d

SHA512
5a81ae74111f379715ad60d03d2091dad96b84a9c232726120a98e4d535a8d652c8bd42757d8bd088b73b10df0019862eb55cd0a46d8f3d53a1b5b62638f559d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
47e704cb82ffac9d261db80e570c45be

SHA1
da6f5dbb39a64aed91e82b3da95e1c243cd0900e

SHA256
ddb47033a5412c5d8c2499b74144eea0db2fa941f62622c921285700fc721a81

SHA512
45413b80276bce50b3777662d3f3d884c417bd95b18c7e02a8c9363f5477c258e9d146b9888b89adc207181747f616bb7c33330fea44ca631c46a73e5f5f64d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
2a7f93a9eab538fcc0454eeca11ca44f

SHA1
89eddb7fc933c463fe82de7ea46ab23402d66e2f

SHA256
aa4c6cd271cc2a55bfc9ba49806f33e8c41a3e2bc4026c020a382c9223409d5d

SHA512
f4ae49ab0114d40224f52863911e81f8b05561e3fd55a2e12a6d6e561c80ace43dc302adbb731c693c92b535c95ca51246cc4ef287dfc7122d805ea011b36056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
07c0199812cb3981bcf08310a043fa7c

SHA1
12d4d2f136c715e319a05a47ae24b9f91e35d435

SHA256
122fbfa03c4abf0a861519984a3e3ad7236b2cbd319a7b6fa582f404276622e9

SHA512
18425a168a5ccfef1142b2f7a197a1d9fd2d8eac6e5e790611608e6f995304e959b5a2be111e555a4e92e410aedaaa3bd309137356a3198f49ac953d6bba6315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a4ae641be91559076abf13e239646bbf

SHA1
1b0a98cfa44cf054225c38e25cf8e335677f31e6

SHA256
5969af3e400ab6b1bd1d2b2dc4ef878646f03dbfa0d70738e557a355253988c5

SHA512
5e8ba31f3f3079e4d992c0e946297f17a889bd7af61dc2ce066ecbb1556953acef5b4fcdf6c57f230df3dfc234884c979218e2063e482cdfd08f98fcc8af6c48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
68b4da4a185275a8849a3e6985bce225

SHA1
b3e7f88e569424037fb0084c5dda1375d47f5be3

SHA256
6b6ba9c5939e3763c93d7ee0f5bc949d5d17f5c49eb39fa471bbfe63447e988c

SHA512
e0f431ac0a54c78eaa2a2c08b32bcbbd562aec49f4360537bf5a9e2806e305d197553e8da1012dad164b045579e9526675ef406477476aadbbf3986d3116c1ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
782dbc5c8d3e9098730e0ac985125841

SHA1
b813161e980e99bdd04decbd779037acfdb190d3

SHA256
de50e7e72212a46036e74ac63bb57e04b94fd724c66866efdd95979d52543424

SHA512
6e9522ec4508df3b855a3900095d6fa57fc01d1c14092b5da72babb0708f5f6f20477fde03425d0bca5f629b59a98e18859d33fcbad806386718d68754ffe8e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d8bf534098e81e6e545589dea9ee41d4

SHA1
e4e8ec949f782cdcf05293ab1a59df9974f50931

SHA256
49e33184f7dc9d53769e820ca75c9d08b1b6b82dc56565190f431ceb6a6240fa

SHA512
ed844fca0fff7dd9862eec9a3e4adb208b82d01f7acc86ee5d0ca77d8fc581abf4bfa192b80dcf8415fa309d1febacfc4ca8d03852c5d70f92b2159c1a47ead2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9ad479ee85edd80c7a9e2f906ef0b4b6

SHA1
36cf2f33f29c7938b7efb22a3d4b45f8e8cf0623

SHA256
26725e8cde49e107e4090252b5095e4d5e1b8e7de83b5abb987aa00981c12e6f

SHA512
60374970922cdb86827f9de3fcaeebf6654ac41e25c1f8880bcd07a19fd3d5369f14a90f2e4212ed0eebd64bcbb91ddd1c59824c02304c8457f450c4a58a4860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
69a2af0811a9b3313947679a18e6284f

SHA1
62b2b602271a87563a55e571b08d5c6bde88220a

SHA256
658716f78769ff99f0eba26395f3df7e86ece561ce37e8a1b8ca62ca8998aaf2

SHA512
4d0ac778e1431c0c349f7f2c96332a942a982e902d1efdb4f3f0075046b9251b6bc876cc28869a21b984417e4a37798bcdda15857224269ebcb981e325f7d971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
c7c56fec8ab211b1d95c42717d2ab608

SHA1
ba091f6c504ec93565402fc7081dbde12f3a1f6c

SHA256
4795bd01a9469b1c5962aa06cb6c8fdbb496071f97027c326d7e8793fc8f8038

SHA512
3e805725bfab8f3defec6025ef90ca45acac717dc425d6de8191d82eb46e0e5c6a14d12d38bffdab8cf25b031f333b12d5161730007bd7ffde6f4323fe2e3058

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7CF3.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2200-6-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/2200-2-0x0000000000120000-0x000000000013B000-memory.dmp

Filesize
108KB

Download
memory/2200-0-0x0000000000C20000-0x0000000000C73000-memory.dmp

Filesize
332KB

Download
memory/2200-1-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download