Overview

overview

10

Static

static

3

6e352a6e96...18.exe

windows7-x64

10

6e352a6e96...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2024 09:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6e352a6e96db293f487d1c1996f7ca60_JaffaCakes118.exe

  • Size

    507KB

  • MD5

    6e352a6e96db293f487d1c1996f7ca60

  • SHA1

    887a357a96b9dbb428b6b776a3ec8ca8de746f18

  • SHA256

    49b84085b7cc731d39fda5a6c15d8bedf3051f3e3f8792f4a50220ebdbf1a4c6

  • SHA512

    bad3b109707b7ba714ccfd41109d6defe9aa2c651cd7dd8c91f536622fa52394071e858a81a2844421a56219527737d395580ea73e250f6cb44c4c1c4959351d

  • SSDEEP

    12288:IEi3NId2zO8PW418jZZUozZuzYgwz3r14Y07KCJ:GrdZ+tZlVUYBzB0KC

Score
10/10
gozibankerdiscoveryisfbpersistencetrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215798

rsa_pubkey.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Users\Admin\AppData\Local\Temp\6e352a6e96db293f487d1c1996f7ca60_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\6e352a6e96db293f487d1c1996f7ca60_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:376
      • C:\Users\Admin\AppData\Local\Temp\6e352a6e96db293f487d1c1996f7ca60_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\6e352a6e96db293f487d1c1996f7ca60_JaffaCakes118.exe"
        3⤵
        • Checks computer location settings
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:964
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C6F4\E37A.bat" "C:\Users\Admin\AppData\Roaming\AcLalg32\biwitenc.exe" "C:\Users\Admin\AppData\Local\Temp\6E352A~1.EXE""
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4452
          • C:\Windows\SysWOW64\cmd.exe
            cmd /C ""C:\Users\Admin\AppData\Roaming\AcLalg32\biwitenc.exe" "C:\Users\Admin\AppData\Local\Temp\6E352A~1.EXE""
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:628
            • C:\Users\Admin\AppData\Roaming\AcLalg32\biwitenc.exe
              "C:\Users\Admin\AppData\Roaming\AcLalg32\biwitenc.exe" "C:\Users\Admin\AppData\Local\Temp\6E352A~1.EXE"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3172
              • C:\Users\Admin\AppData\Roaming\AcLalg32\biwitenc.exe
                "C:\Users\Admin\AppData\Roaming\AcLalg32\biwitenc.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Checks SCSI registry key(s)
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:4928
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe
                  8⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of WriteProcessMemory
                  PID:4848
  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3956
  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:4132
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:832
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
        • Modifies registry class
        PID:2228

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\C6F4\E37A.bat
        Filesize

        112B

        MD5

        23b3bfb647ed59b1cdaf526180d98c08

        SHA1

        b0061a538879eecf3478ea7473883a43ee6562f5

        SHA256

        b3902565ac4d2b3a3815eaa7b3103923fdb3d6476f4c935c307f2bc0ad90dc28

        SHA512

        a5f901d976799b4bfc8a1adf1257c30aa0138af3c4ba02cea47d22b853fab91161e94d8f3e2629f10bb6a88504f43093b27d8cb6ff571177b5400167f6c4e074

        Download Submit

      • C:\Users\Admin\AppData\Roaming\AcLalg32\biwitenc.exe
        Filesize

        507KB

        MD5

        6e352a6e96db293f487d1c1996f7ca60

        SHA1

        887a357a96b9dbb428b6b776a3ec8ca8de746f18

        SHA256

        49b84085b7cc731d39fda5a6c15d8bedf3051f3e3f8792f4a50220ebdbf1a4c6

        SHA512

        bad3b109707b7ba714ccfd41109d6defe9aa2c651cd7dd8c91f536622fa52394071e858a81a2844421a56219527737d395580ea73e250f6cb44c4c1c4959351d

        Download Submit

      • memory/832-53-0x0000027E33700000-0x0000027E33804000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/832-57-0x0000027E33700000-0x0000027E33804000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/964-2-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

        Download

      • memory/964-3-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

        Download

      • memory/964-8-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

        Download

      • memory/964-0-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

        Download

      • memory/2228-58-0x000001518F540000-0x000001518F644000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/2228-66-0x000001518F540000-0x000001518F644000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3484-65-0x0000000008D60000-0x0000000008E64000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3484-36-0x0000000008D60000-0x0000000008E64000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3484-60-0x0000000008D60000-0x0000000008E64000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3484-29-0x0000000008D60000-0x0000000008E64000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3484-35-0x00000000014A0000-0x00000000014A1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3484-64-0x0000000008D60000-0x0000000008E64000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3484-59-0x0000000008D60000-0x0000000008E64000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3484-67-0x0000000008D60000-0x0000000008E64000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3956-46-0x000001D6BA300000-0x000001D6BA404000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3956-68-0x000001D6BA300000-0x000001D6BA404000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3956-40-0x000001D6B9DB0000-0x000001D6B9DB1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3956-41-0x000001D6BA300000-0x000001D6BA404000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/3956-45-0x000001D6BA300000-0x000001D6BA404000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/4132-52-0x000002033ADB0000-0x000002033AEB4000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/4132-69-0x000002033ADB0000-0x000002033AEB4000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/4132-51-0x000002033ADB0000-0x000002033AEB4000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/4848-22-0x0000000000740000-0x0000000000844000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/4848-28-0x0000000000740000-0x0000000000844000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/4848-21-0x0000000000850000-0x0000000000851000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4848-30-0x0000000000740000-0x0000000000844000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/4928-18-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4928-27-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

        Download