gozi | be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83.exe
Size

1.7MB
MD5

63321cff996c538481f0892446222ef8
SHA1

b57fded3fa4056544b62658d1f8b79dcc4ffbebb
SHA256

be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83
SHA512

cffd7fc5018b75e36a03e4f5e23415c4f844ba72780b1343fa200a951175a59a54c2483a45958ae7eed084dfc34ebd23e1d57d69a7a7f1c8c445bd4b1eb299c1
SSDEEP

49152:lsskClXSMDbQmlu5z8RlA6yTizYG9Py+qcuQms33CHlXSMDbQmlu5z8R:lsskClXeIAxizYSy+qRlXe

Score

10^/10

gozi banker discovery isfb trojan

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Executes dropped EXE 1 IoCs

pid	Process
2584	B9_Uninst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B9_Uninst.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	B9_Uninst.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2584	1532	be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83.exe	83
PID 1532 wrote to memory of 2584	1532	be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83.exe	83
PID 1532 wrote to memory of 2584	1532	be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83.exe	83

C:\Users\Admin\AppData\Local\Temp\be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83.exe
"C:\Users\Admin\AppData\Local\Temp\be6667194e1d66042e43ed2f297ee8c46172d802f693e021f3c7b3a62da18e83.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\B9_Uninst.exe
  "C:\Users\Admin\AppData\Local\Temp\B9_Uninst.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B9_Uninst.exe

Filesize
1.4MB

MD5
7e32d9140ab7ed368479ba92773ad587

SHA1
49271eb1df54521714259e5ac5c8323d63474361

SHA256
3cb263715c24f50f80f96496656b114fae9c3119a960cb7a87e4b15c46962e65

SHA512
175536295fd6ecd725cabdba422d13b3513836ffcc3c08b17cb0bac3d9904e6d3cd8c7498560a27f352000b097d1cdba023b22360beb19d5940147cff2b948b5

Download Submit
memory/1532-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1532-5-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2584-6-0x0000000002F30000-0x0000000002F31000-memory.dmp

Filesize
4KB

Download