gozi | hxxps://www[.]yyyyyyy[.]info

Analysis

max time kernel
72s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.yyyyyyy.info

Score

10^/10

gozi banker discovery trojan

Malware Config

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
2332	msedge.exe
2332	msedge.exe
1572	identity_helper.exe
1572	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2716	2332	msedge.exe	85
PID 2332 wrote to memory of 2716	2332	msedge.exe	85
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 2932	2332	msedge.exe	86
PID 2332 wrote to memory of 1424	2332	msedge.exe	87
PID 2332 wrote to memory of 1424	2332	msedge.exe	87
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88
PID 2332 wrote to memory of 1564	2332	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.yyyyyyy.info
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffad16c46f8,0x7ffad16c4708,0x7ffad16c4718
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5362694103177634954,11535993637685009639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4004

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520 0x51c
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
b5f3f56b008b7928ff59dd221a51e12c

SHA1
a2fce702aa31808789dc544891972994439f11c8

SHA256
9c8fea53c79204997c42f7a5a2333ac8b3c7018a9a69d03c448065d5aee40222

SHA512
ddc2af860cf1ee058d6bfe3b98a53898a28659b9bc22c34659aace4a97bc046bca102481da45a2a0d83125e7085cfc7ae376719ba22dc6fe08a784f6e8a44a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
345B

MD5
78c11150e8a9efce539e7a1f309f6157

SHA1
e7a48ebc45abfba40353c10069d91a73ba649a91

SHA256
de5949ce0d45ad36e0772819ce53750c7fbf43e41fb08da0719f6c4e5a75a52d

SHA512
44bb5b30babc79114a44bb1b0407dc57f8e5895318c0230ffa02ad6cdfd55723380019bd81d2c591be13decb30bf5d7d13fe67cc2035e3b13b470b41fa3595c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11f458f08d57b655e66d833865fecf2e

SHA1
06c57e5f851e7d4650678f9b3051e5e230cd3740

SHA256
783f08de0c6a3709d952c1cc72267b2f0d65db0acdd929b5a409bfe4922c523e

SHA512
ea0fa19dcfcb533361a84cdd5b7bb069cf08b83b16bd8b4ea9c49f2227b90af18a6fc2e95188f44e530e6849f3848d90a73eedf0ebf3567dc55edddd3cbaf67c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
422ac45b4939c7a5dfdac9bcf4f246eb

SHA1
5bd6b17d48bc86c75163404a4cee91d4863f5516

SHA256
6d5e2baf4a26a9f74502c8d1d81828e280a0e6cc2d882cd06bf3c3d9cf453c9a

SHA512
5bdc86439e27dc3830221769a648db0856e35d1c0a065551064752101bb3284e046f92d0f6cd2723244f18b93a31cd0b0dea232492ff92350ed22810f041f9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c674edb4175e332155e9d447d54975b

SHA1
4839970c50e982d4d2224057f747821e042f2ee2

SHA256
48f843de8e965f4d2e4b1f35cb3ff4b0f6306cc848a60bc072553eb715e1a447

SHA512
eb6916e0fa97d513d069782de280552c71d259226632f0615a96245893ddaccaaea89d22fd30ca20539ed75ad43ff69d66c116003d0387f60cd3763b9101b219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
502bca3a60cfb910f68c894d39300db0

SHA1
633355f07d7bb12b668d21993648b4e2c367e14c

SHA256
b72d66d1a24063f628d27ffcf26d63564a4b40684ac2d823f7ed376696424df3

SHA512
424d7c8723f718e07aed09415ef9661bbced14a7263e97791f2fc8056be9d3e9ea6fa53a9ad07fdfdf96b26a13ff5c4cb5a4c91787a472fd3534b17212ee8a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eeb5.TMP

Filesize
372B

MD5
57d57ad7805b0f032e726a27f3a3dc70

SHA1
337b16c0f51fb0d8162484461ea75da2138083e6

SHA256
5e9a3743cd1ae1a0b3dce62fbfe2a33f67fc4ac3b82fc4b5d2ea527541bdfe85

SHA512
397724f82dc3b42134572f7da8cfee8b1281e25b827f032015b01b9d604621569718b3f32dbe3a05160c761f63f3bbcd231c4a71923d9ebb19b456e53be35b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c7537ae7a6662dd1cf71714bd6e9a557

SHA1
ffb1c41dffcb7baff012080d1c92c260557bf3a8

SHA256
e8343c2b6c2c3d061ea920720d14a30ded9ca1040794d943fa35e196e512b267

SHA512
269793cdd1ea1120d06149032e1506b4bcd8065c8eec53b18f5f40b4f2d8d4c4fe1e54fa1d66b6f10d49bccf67419b2bbc47a7f055524b170c22f055ebd82808

Download Submit