gozi | 123d973289d40a5a59dd3def92abf1e0f86c6fd06cd8a1b70f31b066d535b6d2

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

123d973289d40a5a59dd3def92abf1e0f86c6fd06cd8a1b70f31b066d535b6d2N.exe
Size

256KB
MD5

bfbcbbd1b22e19b549504e7ad04e95f0
SHA1

3da942784b13e10c36e3fceac8e86e12e4368280
SHA256

123d973289d40a5a59dd3def92abf1e0f86c6fd06cd8a1b70f31b066d535b6d2
SHA512

ebd1fd86e24682f2c8344bfa13eb95edabb46a5863d7d8a2bde27b258b9309c6fb8b4da9bdaa291726e82e4d01928ddae1b1dbd0d07581747ea65ec41dadb5f4
SSDEEP

6144:KVQeVilAqaAKPmKmjHixTAiXLddsrTUqV2y:KVUpKWkTvhqTUqV7

Score

10^/10

gozi 1053 banker isfb persistence trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1053

127.0.0.1

Attributes

exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\COLO32gt = "C:\\Users\\Admin\\AppData\\Roaming\\chsbmifs\\getumf32.exe"	123d973289d40a5a59dd3def92abf1e0f86c6fd06cd8a1b70f31b066d535b6d2N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	123d973289d40a5a59dd3def92abf1e0f86c6fd06cd8a1b70f31b066d535b6d2N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2584	123d973289d40a5a59dd3def92abf1e0f86c6fd06cd8a1b70f31b066d535b6d2N.exe

C:\Users\Admin\AppData\Local\Temp\123d973289d40a5a59dd3def92abf1e0f86c6fd06cd8a1b70f31b066d535b6d2N.exe
"C:\Users\Admin\AppData\Local\Temp\123d973289d40a5a59dd3def92abf1e0f86c6fd06cd8a1b70f31b066d535b6d2N.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-0-0x00000000001C0000-0x00000000001EF000-memory.dmp

Filesize
188KB

Download
memory/2584-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2584-4-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads