Overview

overview

10

Static

static

3

0306ee717c...73.exe

windows7-x64

10

0306ee717c...73.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 19:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0306ee717c581c62eedb21eb4c1b82a64b641d60d71453344419d4944e410c73.exe

  • Size

    2.8MB

  • MD5

    5cbc91e005da99324b10e23bae3b9427

  • SHA1

    beac657232e55493546b8bff5d7636af4e1efc24

  • SHA256

    0306ee717c581c62eedb21eb4c1b82a64b641d60d71453344419d4944e410c73

  • SHA512

    7dd16a565d48b8e05450399b0063dc899bb64c2c119b3599cf5d5fabd86099f0bd4759271a35b7d52007f210de55760f92380bef97351ac95a3a33eb01c237de

  • SSDEEP

    49152:zACqIwBXHuZStR6BohzEOZ/VEoyJGKQkQ0oTW:zACXeXHfH6WVEo4XQ0o

Score
10/10
gozi3555bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    217111

Extracted

Family

gozi

Botnet

3555

C2

settings-win.data.microsoft.com

v60yuuu1415.com

jlb81hdvernon.com

b99vxjju.com
Attributes
  • build

    217111

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Gozi family
    gozi
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0306ee717c581c62eedb21eb4c1b82a64b641d60d71453344419d4944e410c73.exe
    "C:\Users\Admin\AppData\Local\Temp\0306ee717c581c62eedb21eb4c1b82a64b641d60d71453344419d4944e410c73.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4088
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:444
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:348
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2640
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1260 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4932
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1104 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~DF296982D8E0D57E51.TMP
    Filesize

    16KB

    MD5

    e4773524cd0b4aa2b0be29e2d93137f5

    SHA1

    282bb95239c8f10e8f2dff82316d209750e22376

    SHA256

    e6a3cccd8e73b9c443f1ceaae7fd4ddd6bc426bbdab3b59e9c208817cb63988a

    SHA512

    f8dcca02b50912e4003c149b31a57a80c402a6e1085c508f17217d2dccaafd56e49850a256084628e39b514be5fb18123cb54399d3f9b758b148d263b04be465

    Download Submit

  • memory/4088-1-0x0000000000E60000-0x0000000000E63000-memory.dmp

    Filesize

    12KB

    Download

  • memory/4088-2-0x0000000000BD0000-0x0000000000F58000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/4088-3-0x0000000003220000-0x000000000322F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/4088-6-0x0000000000BD0000-0x0000000000F58000-memory.dmp

    Filesize

    3.5MB

    Download