Malware Analysis Report

2024-10-16 02:27

Sample ID 240702-3erdkszbrp
Target f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af
SHA256 f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af
Tags
gozi banker isfb trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af

Threat Level: Known bad

The file f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af was found to be: Known bad.

Malicious Activity Summary

gozi banker isfb trojan upx

Gozi

Gozi family

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

UPX packed file

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-02 23:25

Signatures

Gozi family

gozi

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-02 23:25

Reported

2024-07-02 23:28

Platform

win7-20240611-en

Max time kernel

122s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe"

Signatures

Gozi

banker trojan gozi

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Public\xiaodaxzqxia\v.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\hh.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\hh.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2920 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\cmd.exe
PID 2920 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\cmd.exe
PID 2920 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\cmd.exe
PID 2920 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\cmd.exe
PID 2920 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\WScript.exe
PID 2920 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\WScript.exe
PID 2920 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\WScript.exe
PID 2920 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\WScript.exe
PID 1588 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1588 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1588 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1588 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2052 wrote to memory of 2628 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2052 wrote to memory of 2628 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2052 wrote to memory of 2628 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2052 wrote to memory of 2628 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2628 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2628 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2628 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2628 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2920 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Users\Public\xiaodaxzqxia\v.exe
PID 2920 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Users\Public\xiaodaxzqxia\v.exe
PID 2920 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Users\Public\xiaodaxzqxia\v.exe
PID 2920 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Users\Public\xiaodaxzqxia\v.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe

"C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Public\xiaodaxzqxia\n.bat

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Public\xiaodaxzqxia\A.vbs"

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" /v "1201" /d "0" /t REG_DWORD /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Public\xiaodaxzqxia\n.bat" "

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" /v "1201" /d "0" /t REG_DWORD /f

C:\Users\Public\xiaodaxzqxia\v.exe

"C:\Users\Public\xiaodaxzqxia\v.exe" -o -d C:\Users\Public\xiaodaxzqxia C:\Users\Public\xiaodaxzqxia\111

C:\Windows\hh.exe

"C:\Windows\hh.exe" C:\Users\Public\cxzvasdfg\8510366750615495\A11.chm

C:\Windows\hh.exe

"C:\Windows\hh.exe" C:\Users\Public\cxzvasdfg\8510366750615495\A11.chm

Network

Country Destination Domain Proto
US 8.8.8.8:53 xcnm.tooo.top udp
CN 39.98.154.156:23668 xcnm.tooo.top tcp
CN 39.98.154.156:23668 xcnm.tooo.top tcp
CN 39.98.154.156:23668 xcnm.tooo.top tcp

Files

memory/2920-0-0x0000000000400000-0x0000000000719000-memory.dmp

C:\Users\Public\xiaodaxzqxia\n.bat

MD5 c7d8b33e05722104d63de564a5d92b01
SHA1 fd703f1c71ac1dae65dc34f3521854604cec8091
SHA256 538ce88a3eed5a98c6a021a4c541080c5cfb652962f37da620e35b537513317a
SHA512 54a80fc6ad3f08743dc1655c379de79f9496086a9a18f4716fc9a9d6a6fe4fd527dd4ac099c57408090b73903c64fa38d4723783708068878aa6e18c6cc0d08e

C:\Users\Public\xiaodaxzqxia\A.vbs

MD5 bcb223ea9c0598f04684216bcd0e12a6
SHA1 2661c8fbca3654a29fa261def7f16ea23a6f3165
SHA256 ef2113720c94cbe4cb494d6e24d26803b4b1a094e35e4285cd4a2f5665ef2c37
SHA512 77e440462544ca9f711f9241096601060080f5751651cab8a796d57ed74c424f03a9237a653c17a386c1ef654e6192d0e54080632dacff15a28a46564e639682

memory/2920-13-0x0000000000400000-0x0000000000719000-memory.dmp

C:\Users\Public\xiaodaxzqxia\v.exe

MD5 fecf803f7d84d4cfa81277298574d6e6
SHA1 0fd9a61bf9a361f87661de295e70a9c6795fe6a1
SHA256 81046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a
SHA512 a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4

memory/2740-29-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Public\cxzvasdfg\8510366750615495\A11.chm

MD5 8dc3f638086ac2a3c5add4d77dcc0468
SHA1 1112422c310809cbc9659f44a3f25bc123d2f822
SHA256 8650d112c9b776fd5cc8644178daad65ce131da397e82f38d25e39ab70d86d0f
SHA512 a6436bee9441b709f5f6c54e1da854f1e0fe4483fb9e757e8422d9d72f19975b20c982e8dd1adadd8ed27378346905795c06ae99aab4183fa6bff2bb768fbd8d

C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat

MD5 942e2f8e990c1092b87f14522e4fb217
SHA1 a7e4a678a8e122263c3591a040c4194938f420e9
SHA256 ba551afebaed2900be08c1e3b376733209a12afe2b8c9997c13a712007c97a1f
SHA512 054239569df0002e86d37f696b4cec61be1a7b0d21baaabed9f46578e1878664a6e56b92c45e2e4070779fddcf703f7b878521e4ebb55cf3faf5c00de1865456

memory/2920-38-0x0000000000400000-0x0000000000719000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-02 23:25

Reported

2024-07-02 23:28

Platform

win10v2004-20240508-en

Max time kernel

44s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe"

Signatures

Gozi

banker trojan gozi

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Public\xiaodaxzqxia\v.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5112 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\cmd.exe
PID 5112 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\cmd.exe
PID 5112 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\cmd.exe
PID 5112 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\WScript.exe
PID 5112 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\WScript.exe
PID 5112 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Windows\SysWOW64\WScript.exe
PID 2992 wrote to memory of 3452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2992 wrote to memory of 3452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2992 wrote to memory of 3452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4820 wrote to memory of 4612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4820 wrote to memory of 4612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4820 wrote to memory of 4612 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4612 wrote to memory of 3664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4612 wrote to memory of 3664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4612 wrote to memory of 3664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5112 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Users\Public\xiaodaxzqxia\v.exe
PID 5112 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Users\Public\xiaodaxzqxia\v.exe
PID 5112 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe C:\Users\Public\xiaodaxzqxia\v.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe

"C:\Users\Admin\AppData\Local\Temp\f4f0429f3d67de78283f6814ae9f914391048dba16eee664292ed13c326348af.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Public\xiaodaxzqxia\n.bat

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Public\xiaodaxzqxia\A.vbs"

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" /v "1201" /d "0" /t REG_DWORD /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\xiaodaxzqxia\n.bat" "

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" /v "1201" /d "0" /t REG_DWORD /f

C:\Users\Public\xiaodaxzqxia\v.exe

"C:\Users\Public\xiaodaxzqxia\v.exe" -o -d C:\Users\Public\xiaodaxzqxia C:\Users\Public\xiaodaxzqxia\111

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\hh.exe

"C:\Windows\hh.exe" C:\Users\Public\cxzvasdfg\2241323910214173\A11.chm

C:\Windows\hh.exe

"C:\Windows\hh.exe" C:\Users\Public\cxzvasdfg\2241323910214173\A11.chm

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 xcnm.tooo.top udp
US 8.8.8.8:53 xcnm.tooo.top udp
US 8.8.8.8:53 xcnm.tooo.top udp

Files

memory/5112-0-0x0000000000400000-0x0000000000719000-memory.dmp

C:\Users\Public\xiaodaxzqxia\n.bat

MD5 c7d8b33e05722104d63de564a5d92b01
SHA1 fd703f1c71ac1dae65dc34f3521854604cec8091
SHA256 538ce88a3eed5a98c6a021a4c541080c5cfb652962f37da620e35b537513317a
SHA512 54a80fc6ad3f08743dc1655c379de79f9496086a9a18f4716fc9a9d6a6fe4fd527dd4ac099c57408090b73903c64fa38d4723783708068878aa6e18c6cc0d08e

C:\Users\Public\xiaodaxzqxia\A.vbs

MD5 bcb223ea9c0598f04684216bcd0e12a6
SHA1 2661c8fbca3654a29fa261def7f16ea23a6f3165
SHA256 ef2113720c94cbe4cb494d6e24d26803b4b1a094e35e4285cd4a2f5665ef2c37
SHA512 77e440462544ca9f711f9241096601060080f5751651cab8a796d57ed74c424f03a9237a653c17a386c1ef654e6192d0e54080632dacff15a28a46564e639682

memory/5112-8-0x0000000000400000-0x0000000000719000-memory.dmp

C:\Users\Public\xiaodaxzqxia\v.exe

MD5 fecf803f7d84d4cfa81277298574d6e6
SHA1 0fd9a61bf9a361f87661de295e70a9c6795fe6a1
SHA256 81046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a
SHA512 a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4

memory/4472-20-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Public\cxzvasdfg\2241323910214173\A11.chm

MD5 8dc3f638086ac2a3c5add4d77dcc0468
SHA1 1112422c310809cbc9659f44a3f25bc123d2f822
SHA256 8650d112c9b776fd5cc8644178daad65ce131da397e82f38d25e39ab70d86d0f
SHA512 a6436bee9441b709f5f6c54e1da854f1e0fe4483fb9e757e8422d9d72f19975b20c982e8dd1adadd8ed27378346905795c06ae99aab4183fa6bff2bb768fbd8d

C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat

MD5 2cecc1a89e4c2ec00248bc61e2e0f486
SHA1 02ee2356db70bcbb3a7f096d32486326a5679cef
SHA256 12ebc0cd0a86f1267d46acb4c004b51583ae9b4ade1874c1fb376c250e4a302c
SHA512 285c249c2365aa79de6088b94c521055f900d973d87eaff12d382fe123f572b62f18d6ee9d4d2903e23af66696291ebf82f8720d4cc898197c2e2248a6567a55

memory/5112-32-0x0000000000400000-0x0000000000719000-memory.dmp