gozi | b53e33675de30f4bf86518bc21c104bc88ee97025b3a47d8c697b0539e50cd34

General

Target

f3d8f2cf1d8faf3bf57fa4fb53f28140_JaffaCakes118.exe
Size

228KB
MD5

f3d8f2cf1d8faf3bf57fa4fb53f28140
SHA1

00490312cd86766657bb413e66deb81144ed3a96
SHA256

b53e33675de30f4bf86518bc21c104bc88ee97025b3a47d8c697b0539e50cd34
SHA512

c14c5149fd7daaf0987a829bd3157e5ad5e70c746fa67347393cbb0bc92e74ddcfba1ed435edaa01b4bc54ccdac84338ab46d34ceb551401026b6254ebb79b50
SSDEEP

3072:hC0fyjm4tt4JVJrwfv1hdjZhsfYy3tXwpY1GMOJd4t1p+srU3qH4VdW2Ujuy/zSz:FydttkVJrqxLAwVMO+v+sSEdK

Score

10^/10

gozi 1000 banker discovery isfb persistence trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1000

C2

rababyici.com

vurufvapu.com

nighibnos.com

Attributes

exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	f3d8f2cf1d8faf3bf57fa4fb53f28140_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
312	compbase.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BinginRT = "C:\\Users\\Admin\\AppData\\Roaming\\cmpblper\\compbase.exe"	f3d8f2cf1d8faf3bf57fa4fb53f28140_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	compbase.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3d8f2cf1d8faf3bf57fa4fb53f28140_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	f3d8f2cf1d8faf3bf57fa4fb53f28140_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	f3d8f2cf1d8faf3bf57fa4fb53f28140_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 3372	3864	f3d8f2cf1d8faf3bf57fa4fb53f28140_JaffaCakes118.exe	101
PID 3864 wrote to memory of 3372	3864	f3d8f2cf1d8faf3bf57fa4fb53f28140_JaffaCakes118.exe	101
PID 3864 wrote to memory of 3372	3864	f3d8f2cf1d8faf3bf57fa4fb53f28140_JaffaCakes118.exe	101
PID 3372 wrote to memory of 4644	3372	cmd.exe	103
PID 3372 wrote to memory of 4644	3372	cmd.exe	103
PID 3372 wrote to memory of 4644	3372	cmd.exe	103
PID 4644 wrote to memory of 312	4644	cmd.exe	104
PID 4644 wrote to memory of 312	4644	cmd.exe	104
PID 4644 wrote to memory of 312	4644	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\f3d8f2cf1d8faf3bf57fa4fb53f28140_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3d8f2cf1d8faf3bf57fa4fb53f28140_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B51C\B2D2.bat" "C:\Users\Admin\AppData\Roaming\cmpblper\compbase.exe" "C:\Users\Admin\AppData\Local\Temp\F3D8F2~1.EXE""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C ""C:\Users\Admin\AppData\Roaming\cmpblper\compbase.exe" "C:\Users\Admin\AppData\Local\Temp\F3D8F2~1.EXE""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Users\Admin\AppData\Roaming\cmpblper\compbase.exe
      "C:\Users\Admin\AppData\Roaming\cmpblper\compbase.exe" "C:\Users\Admin\AppData\Local\Temp\F3D8F2~1.EXE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B51C\B2D2.bat

Filesize
112B

MD5
e9fca0a576339b301becf0825540506f

SHA1
f58d54d0143aacba8fb25340ea25fb10a26a3672

SHA256
3696d8858c9c77fe177a0c02a8092f9e917cd57e35c4cf60e81cc2bb3f2a2102

SHA512
29bbc6a97680c913d99618041a2c910fd1d932d35a005b0898674326478dd6227c5f1bb94e9b77b460aea9b14aa89b942d12fbcdb7cdc76412283fa9129deb4c

Download Submit
C:\Users\Admin\AppData\Roaming\cmpblper\compbase.exe

Filesize
228KB

MD5
f3d8f2cf1d8faf3bf57fa4fb53f28140

SHA1
00490312cd86766657bb413e66deb81144ed3a96

SHA256
b53e33675de30f4bf86518bc21c104bc88ee97025b3a47d8c697b0539e50cd34

SHA512
c14c5149fd7daaf0987a829bd3157e5ad5e70c746fa67347393cbb0bc92e74ddcfba1ed435edaa01b4bc54ccdac84338ab46d34ceb551401026b6254ebb79b50

Download Submit
memory/312-25-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/312-27-0x0000000000AA0000-0x0000000000AA3000-memory.dmp

Filesize
12KB

Download
memory/312-28-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3864-0-0x0000000000590000-0x0000000000593000-memory.dmp

Filesize
12KB

Download
memory/3864-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3864-3-0x00000000005A0000-0x00000000005A3000-memory.dmp

Filesize
12KB

Download
memory/3864-4-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3864-20-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads