gozi | d8817b61c1649d35eeeb63914f96f6fc77da229e3dde357b2b160af4db9a0b9e

General

Target

e592e1dea886d83e1362d68ad1d6f703_JaffaCakes118.exe
Size

361KB
MD5

e592e1dea886d83e1362d68ad1d6f703
SHA1

f720dc9f5b0cc9c7a9ac88626aa19a78969882f5
SHA256

d8817b61c1649d35eeeb63914f96f6fc77da229e3dde357b2b160af4db9a0b9e
SHA512

42ec2594609e1f12b2d8b17bd4a2a5053580d95abdca68e23eb1cf2c645ea011f55b535ad9657b2bc4b0b61cc048cd3b2400c75372c69e28f7ef74737d76e39e
SSDEEP

6144:jIVQv0y3NRJO22A8oos+W0OBMgxDy1+yAD20GvPYE8a:cVQvBNfORjVOB7xDQ1AD20GXYEZ

Score

10^/10

gozi 1010 banker discovery isfb persistence trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1010

C2

diuolirt.at

deopliazae.at

nifredao.com

filokiyurt.at

Attributes

exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	e592e1dea886d83e1362d68ad1d6f703_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1836	AUDIbapi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiptsp = "C:\\Users\\Admin\\AppData\\Roaming\\certwmdm\\AUDIbapi.exe"	e592e1dea886d83e1362d68ad1d6f703_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	1836	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AUDIbapi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e592e1dea886d83e1362d68ad1d6f703_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1836	AUDIbapi.exe
1836	AUDIbapi.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 2316	4356	e592e1dea886d83e1362d68ad1d6f703_JaffaCakes118.exe	86
PID 4356 wrote to memory of 2316	4356	e592e1dea886d83e1362d68ad1d6f703_JaffaCakes118.exe	86
PID 4356 wrote to memory of 2316	4356	e592e1dea886d83e1362d68ad1d6f703_JaffaCakes118.exe	86
PID 2316 wrote to memory of 1496	2316	cmd.exe	88
PID 2316 wrote to memory of 1496	2316	cmd.exe	88
PID 2316 wrote to memory of 1496	2316	cmd.exe	88
PID 1496 wrote to memory of 1836	1496	cmd.exe	89
PID 1496 wrote to memory of 1836	1496	cmd.exe	89
PID 1496 wrote to memory of 1836	1496	cmd.exe	89
PID 1836 wrote to memory of 220	1836	AUDIbapi.exe	90
PID 1836 wrote to memory of 220	1836	AUDIbapi.exe	90

C:\Users\Admin\AppData\Local\Temp\e592e1dea886d83e1362d68ad1d6f703_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e592e1dea886d83e1362d68ad1d6f703_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\86A0\C350.bat" "C:\Users\Admin\AppData\Roaming\certwmdm\AUDIbapi.exe" "C:\Users\Admin\AppData\Local\Temp\E592E1~1.EXE""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C ""C:\Users\Admin\AppData\Roaming\certwmdm\AUDIbapi.exe" "C:\Users\Admin\AppData\Local\Temp\E592E1~1.EXE""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Users\Admin\AppData\Roaming\certwmdm\AUDIbapi.exe
      "C:\Users\Admin\AppData\Roaming\certwmdm\AUDIbapi.exe" "C:\Users\Admin\AppData\Local\Temp\E592E1~1.EXE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Windows\system32\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 584
        5⤵
        Program crash
        
        PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1836 -ip 1836
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\86A0\C350.bat

Filesize
112B

MD5
b0c8939e73c65b1e14cd4c72bc2cb264

SHA1
34c142a12444ab0a3826b182e631f55025d15bec

SHA256
adfac62ab4e882245b6dc71e84714026ae723e229399d0c23b2b24a8e26a2959

SHA512
e40c56af645554f5f4f5ed111bac6ab8a97be3e4bb3cc2400c936df1ed48cf40532e80296ca8c04d881475754d22ad2919b3b645fb0cf0b639f08858e86ecff5

Download Submit
C:\Users\Admin\AppData\Roaming\certwmdm\AUDIbapi.exe

Filesize
361KB

MD5
e592e1dea886d83e1362d68ad1d6f703

SHA1
f720dc9f5b0cc9c7a9ac88626aa19a78969882f5

SHA256
d8817b61c1649d35eeeb63914f96f6fc77da229e3dde357b2b160af4db9a0b9e

SHA512
42ec2594609e1f12b2d8b17bd4a2a5053580d95abdca68e23eb1cf2c645ea011f55b535ad9657b2bc4b0b61cc048cd3b2400c75372c69e28f7ef74737d76e39e

Download Submit
memory/1836-14-0x00000000020B0000-0x00000000020E0000-memory.dmp

Filesize
192KB

Download
memory/1836-12-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1836-15-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4356-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4356-2-0x00000000005E0000-0x0000000000610000-memory.dmp

Filesize
192KB

Download
memory/4356-7-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads