Overview

overview

10

Static

static

3

f76b81b039...18.dll

windows7-x64

10

f76b81b039...18.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/09/2024, 03:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f76b81b0397ae313b8f6d19d95c49edf_JaffaCakes118.dll

  • Size

    352KB

  • MD5

    f76b81b0397ae313b8f6d19d95c49edf

  • SHA1

    8f15106b524cc5db564845508a04ee3bf2709949

  • SHA256

    3e8b92cda2c0d1dc74de0b060f43c2baf23ab08af69667ddbbe66f78d5e0389a

  • SHA512

    d473bb6f8ae26418dffe3e9acaf6266e305c012b2fb57d5e82c8ffbc4c9cae6f1a4e496d5f3bdf0b7228964862a392f552b5847370331d8ad5fea9be7f3af9a6

  • SSDEEP

    6144:b87Sm49lFRQSAe5klIQm3n/ym1grjpY7nf9+v3lYdkv+hgG2xnG4c/gU:fm+3QSAdm3n/yogZgwv3Gqv0gG2tG4gv

Score
10/10
gozi1100bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1100

C2

api10.laptok.at/api1

golang.feel500.at/api1

go.in100k.at/api1
Attributes
  • build

    250180

  • exe_type

    loader

  • server_id

    730

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f76b81b0397ae313b8f6d19d95c49edf_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\f76b81b0397ae313b8f6d19d95c49edf_JaffaCakes118.dll
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2652
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1036
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4084 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3576
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2892
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5052
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5052 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3000
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1132 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~DF1AAA4921713595FD.TMP
    Filesize

    16KB

    MD5

    6bb0d53d60b2fc8701693cd03b3a09a5

    SHA1

    d35a89132bd088a99655861a78999dbf6d1ac172

    SHA256

    7bc5b2b0d835745bb56b0e433a63b64bbac3d8d9fd8061111df57bc2ca981e2f

    SHA512

    03dff7baa3613e6a83906ccd62178b9029788123eaf9510fe0df678ce6f6a661ab9d488541e02abb4e5b5fd9007d2350813b3fa874933cfe88a161019916e3a6

    Download Submit

  • memory/2652-0-0x0000000010054000-0x0000000010058000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2652-1-0x0000000010000000-0x00000000100B5000-memory.dmp

    Filesize

    724KB

    Download

  • memory/2652-2-0x0000000010000000-0x00000000100B5000-memory.dmp

    Filesize

    724KB

    Download

  • memory/2652-3-0x0000000010000000-0x00000000100B5000-memory.dmp

    Filesize

    724KB

    Download

  • memory/2652-4-0x0000000010054000-0x0000000010058000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2652-5-0x0000000010000000-0x00000000100B5000-memory.dmp

    Filesize

    724KB

    Download

  • memory/2652-6-0x0000000010000000-0x00000000100B5000-memory.dmp

    Filesize

    724KB

    Download

  • memory/2652-7-0x0000000000D10000-0x0000000000D20000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2652-10-0x0000000010000000-0x00000000100B5000-memory.dmp

    Filesize

    724KB

    Download