gozi | 42c628377c5d6c65a92eceac5318956cba74b57ac1db74b53f1b8ee78fdb930d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2024, 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
Size

332KB
MD5

bb6d954cff5dffe6c192e6a0afbc2700
SHA1

03fa0ed4520a290623c6133f55ae4b47d6bd6088
SHA256

42c628377c5d6c65a92eceac5318956cba74b57ac1db74b53f1b8ee78fdb930d
SHA512

68e3700a9fc95dfc1db68ebcc7d98613dc4eb4d7ee9c4ccac300d7d488624803aca4bf52f794910770224f9b6f1fa6108c57e52376fe32be2b4bd613e951ccc3
SSDEEP

6144:dxRpCwVKtopdURFJYwZYtuqMOISti9gSZRnuEN/F825TGc2ATMtGiZ:dEw5pdURFJYiq7ISA9gusfAoL

Score

10^/10

gozi 3004 banker discovery isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

3004

volaya.ru

mankiza.ru

blog.click-catalog.ru

news.new-webs.ru

new-run.cc

new-run.pk

Attributes

exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
3396	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
3396	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
3396	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
3396	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
3396	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
3396	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
3396	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
3396	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82
PID 1112 wrote to memory of 3396	1112	bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\bb6d954cff5dffe6c192e6a0afbc2700_JaffaCakes118.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-0-0x0000000000660000-0x0000000000664000-memory.dmp

Filesize
16KB

Download
memory/3396-1-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/3396-2-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/3396-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download