Overview

overview

10

Static

static

3

af01d12df0...77.exe

windows7-x64

10

af01d12df0...77.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-12-2024 21:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    af01d12df06f34e81f3772a1b661eef4f9086a73d953ea1c92a8408c4efa2e77.exe

  • Size

    293KB

  • MD5

    8c79a57ed866e5382f054567bb4dcd6a

  • SHA1

    a3418e0724691c5d103238004f8ed546d560e5c4

  • SHA256

    af01d12df06f34e81f3772a1b661eef4f9086a73d953ea1c92a8408c4efa2e77

  • SHA512

    49eb95f1748854a3dc846f35df02ed2dbff64b29732bd248f91bbb693256ad3ff9eb5a41b07eca789982392152ff6535a0e33f06646683eb8c182f77191d4c80

  • SSDEEP

    6144:1lJBbCGiQedkMGM37T2iG+wBvAKLVqbNqb2:zbDidyMGs7w+w5jLVqZ

Score
10/10
gozi7621bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7621

C2

forumlines.top

linkspremium.ru

premiumlists.ru
Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Gozi family
    gozi
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af01d12df06f34e81f3772a1b661eef4f9086a73d953ea1c92a8408c4efa2e77.exe
    "C:\Users\Admin\AppData\Local\Temp\af01d12df06f34e81f3772a1b661eef4f9086a73d953ea1c92a8408c4efa2e77.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4720
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4784
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3588
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3588 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1232
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3516 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:552
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2952
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1040
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3960

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~DF0761CFA927F7759D.TMP
    Filesize

    16KB

    MD5

    45e8f7a342c2cf2f2501234c24907e71

    SHA1

    7b47b185eb1f167aecbd896d59d64459ae27b4e1

    SHA256

    061c13ba1edcbb9629d58a533b39c929de284a4eba1b6177a29b60dd4d3cee70

    SHA512

    c2dd464284deed1183e14e741e50efea49f174cb1b2d518617a3cd9317fa3980270eedb8f6e67c3bf03b9d3c42c93f8c5b912a643878b3ea77125add305b5351

    Download Submit

  • memory/4720-1-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4720-2-0x0000000000650000-0x000000000065B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/4720-3-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/4720-4-0x0000000000670000-0x000000000067D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/4720-14-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4720-15-0x0000000000650000-0x000000000065B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/4720-17-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/4720-16-0x0000000000400000-0x00000000004EE000-memory.dmp

    Filesize

    952KB

    Download