gozi | 5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9e3f15a41b6dd4ab25d95a957abee6a_JaffaCakes118.exe
Size

1.2MB
MD5

f9e3f15a41b6dd4ab25d95a957abee6a
SHA1

794e1343af82ac981e77a5c086ed9e6c25ecfbc1
SHA256

5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed
SHA512

1668c15a607080703aded55eb0b1460c1d27ad441cff1fce3d0720c24a1e359f96ce72d64c7c69778a63f1d158fd30d7a731fe61bda297a81ad267f86ba9c2c6
SSDEEP

12288:VHsl/AEzRy7dHsMKtBKwY9Y4UDivaKG1HaCAD1rtm9qSymkA97k:Vb8RGHHUD5Ha0kSOA9

Score

10^/10

gozi banker discovery isfb trojan

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9e3f15a41b6dd4ab25d95a957abee6a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f9e3f15a41b6dd4ab25d95a957abee6a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9e3f15a41b6dd4ab25d95a957abee6a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2540-0-0x000000000043F000-0x0000000000442000-memory.dmp

Filesize
12KB

Download
memory/2540-2-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/2540-1-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/2540-3-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/2540-4-0x0000000002EC0000-0x0000000002EFA000-memory.dmp

Filesize
232KB

Download
memory/2540-11-0x0000000002EC0000-0x0000000002EFA000-memory.dmp

Filesize
232KB

Download
memory/2540-12-0x000000000043F000-0x0000000000442000-memory.dmp

Filesize
12KB

Download