gozi | 651fbb8dae5a944f135bf243d571096ff74a0c09c0de7ebd91eefb109b695190

Analysis

max time kernel
93s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

651fbb8dae5a944f135bf243d571096ff74a0c09c0de7ebd91eefb109b695190N.exe
Size

364KB
MD5

30b8fe81b13401aeb716bbeeac871540
SHA1

64f40ae9adf31a683c208e200cb9bfc4c42935e4
SHA256

651fbb8dae5a944f135bf243d571096ff74a0c09c0de7ebd91eefb109b695190
SHA512

7324c099d4df6fb9339364940d35c9170a19cd7fafd5d448bc708c7c019c6f15c60e32881cac9dad333ba7de7e5bbb3f036e5bf2e1e15799bda8793709c83870
SSDEEP

1536:GnfzXF8CvrJ4PBhDP35h6hy+lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:efh8k6DP3z6h3ltOrWKDBr+yJb

Score

10^/10

gozi banker discovery isfb trojan

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1420 3100 WerFault.exe 651fbb8dae5a944f135bf243d571096ff74a0c09c0de7ebd91eefb109b695190N.exe

pid	pid_target	process	target process
1420	3100	WerFault.exe	651fbb8dae5a944f135bf243d571096ff74a0c09c0de7ebd91eefb109b695190N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

651fbb8dae5a944f135bf243d571096ff74a0c09c0de7ebd91eefb109b695190N.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	651fbb8dae5a944f135bf243d571096ff74a0c09c0de7ebd91eefb109b695190N.exe

C:\Users\Admin\AppData\Local\Temp\651fbb8dae5a944f135bf243d571096ff74a0c09c0de7ebd91eefb109b695190N.exe
"C:\Users\Admin\AppData\Local\Temp\651fbb8dae5a944f135bf243d571096ff74a0c09c0de7ebd91eefb109b695190N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 220
  2⤵
  - Program crash
  PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3100 -ip 3100
1⤵
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3100-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3100-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download