gozi | 9ee54571151efbd253a30211dbe7beaf57aca1b1ed8aae48de72f83d43897c3d

General

Target

ac7bc5c4953f3cdf488f98d2bdfe0bf9_JaffaCakes118.exe
Size

268KB
MD5

ac7bc5c4953f3cdf488f98d2bdfe0bf9
SHA1

8dcc3ffa6aed4b42990d63248db3621e2165d9ac
SHA256

9ee54571151efbd253a30211dbe7beaf57aca1b1ed8aae48de72f83d43897c3d
SHA512

2a25edece0a2ebb8cf8cae2cad742968b09160eaa7a6cbafb3d83a6f62b642efed041f3d9aacf26135125db491032e2385a1139d6c976e362cae3a4fd78c6117
SSDEEP

6144:bjGlumlDoFoiADf3N5uYU6REjMmgJpUgiT:bjG8mOF9C/N5uYUdjMmaziT

Score

10^/10

gozi 6000 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
214082

Extracted

Family

gozi

Botnet

6000

C2

http://velooiisd.club

Attributes

build
214082
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112902"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112902"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eb72cc72b20ef74a9de8f0d8e6715ea300000000020000000000106600000001000020000000919aac4ec81c15c4820a48786f670302304dc2d89465189c10219cc65d915017000000000e800000000200002000000008618fa9a09326d9ebd291e0ee83b0e14de4b48740b06fbbce1cf17cf42e71e92000000080d8631c5e79e2850d48e21d1c03d664c1033f79764e4b03b508918672ccb06f40000000a0c2874868dd52c1f27192e120dbd9dd4ce486721bae98308f42829186722049982a59be5a0c4cb57330bfa0706bcc4b18d25b8990c41e7d500323e87d8b1a98	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2961401398"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c80bcbc6beda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E1AB9870-2AB9-11EF-B9F7-4640DA9D21C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2961401398"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31112902"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3177651612"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a084eacac6beda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eb72cc72b20ef74a9de8f0d8e6715ea300000000020000000000106600000001000020000000b3cdb5d9f3c61f284ec23844da2f2702aad9491bb85fbadec1f6d201b5fd40bd000000000e80000000020000200000005956b2b4a1ba101dd05fb8c650ba5b85ce164f968af3c7563cd0a9734c3a43ea200000003103f5da415e2c8d4e80d0d8719d7b752f7a361e8cb8bfc682367d0a7abd312b40000000f90c2ecca5f8690511479f5c888ed2a4c5efc7a6fc7a4f5b5c7dfc16964c1838adacd02b5f24189ed4f22472d0df5e57fa8b5f673c23189966e53eed984b8bbd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3828 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3828 iexplore.exe
3828 iexplore.exe
2160 IEXPLORE.EXE
2160 IEXPLORE.EXE

pid	process
3828	iexplore.exe

pid	process
3828	iexplore.exe
3828	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3828 wrote to memory of 2160	3828	iexplore.exe	IEXPLORE.EXE
PID 3828 wrote to memory of 2160	3828	iexplore.exe	IEXPLORE.EXE
PID 3828 wrote to memory of 2160	3828	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\ac7bc5c4953f3cdf488f98d2bdfe0bf9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac7bc5c4953f3cdf488f98d2bdfe0bf9_JaffaCakes118.exe"
1⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3264

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:2724

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
3d82010fe5c2559538cb93fffa3297a8

SHA1
b02cd4e4929db411ecae28de691ec73a84863d4c

SHA256
6cc835432fca96a9eaccc9c5f6e0d5e0d705c35a57eba81f4d966386c3638055

SHA512
8fac3f8d7b17d8bcb1d8cc725fce6fd150428956883f216ea39b813ee054c6e45ec292053a4569bb5286094ef0a154a20e6463a277c6d03284f0390f35f5d1ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
7d0195c98a10310a312adaab237fe96d

SHA1
f865f64c944c432c80c252b6243ce53854468df7

SHA256
ead95e8ec35e09e5df8391cc47232f0e4b7b3c54b89b411763d662abce2e54f6

SHA512
4ea179a79f0da6052f5ec0271d8bfcc6fee89573cbdf42ef9d72588dfe64a2f6ccc7bc00f09d3b0a54bda113ff607aab580cacab4b8f76bfdfa8271ad2283930

Download Submit
memory/4656-2-0x0000000005540000-0x0000000005640000-memory.dmp

Filesize
1024KB

Download
memory/4656-1-0x0000000000400000-0x00000000052A3000-memory.dmp

Filesize
78.6MB

Download
memory/4656-3-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4656-4-0x0000000005750000-0x000000000575F000-memory.dmp

Filesize
60KB

Download
memory/4656-12-0x0000000005540000-0x0000000005640000-memory.dmp

Filesize
1024KB

Download
memory/4656-13-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads