Overview

overview

10

Static

static

3

d61ee5e7b1...d7.dll

windows7-x64

10

d61ee5e7b1...d7.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2024 12:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d61ee5e7b17684983ea9049f719beb05978a813638f53f7625e970bae1c2abd7.dll

  • Size

    370KB

  • MD5

    0179f7b0bd61f06d3705812e50583b20

  • SHA1

    c640e2e26b783093c8b1d418af11f468c828458f

  • SHA256

    d61ee5e7b17684983ea9049f719beb05978a813638f53f7625e970bae1c2abd7

  • SHA512

    d00906234a788e2237d3debe3a7d9cd9f65cfa1c8b189e9f9f7cfda8f174257e2683f1b94e6667af2d4160f3aa7ebe393de299ce6d9ec3c7b817bc195985df6e

  • SSDEEP

    6144:dtukWLu3M+uqn3F6vPNZAdSEJayJjVSSfz2y/huNT+:bWLuc+uKCqdSEJPNVSSP58T

Score
10/10
gozi7618bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7618

C2

cloudlines.top

linkspremium.ru

premiumlists.ru
Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Gozi family
    gozi
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d61ee5e7b17684983ea9049f719beb05978a813638f53f7625e970bae1c2abd7.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\d61ee5e7b17684983ea9049f719beb05978a813638f53f7625e970bae1c2abd7.dll
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4840
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4568
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:220
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2692
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:688
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:688 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3636
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3812
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3812 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~DF1D755CB977774801.TMP
    Filesize

    16KB

    MD5

    6f7386e2a5773eca8159d1fc4b6de368

    SHA1

    3d9e72ca41961eb723bfd79983daaf7e27ade10a

    SHA256

    159a1f8fe88e39643f0f8574acba1b85a2e058f1a8ce99bc3df5b0d95acd1a9e

    SHA512

    b4ae17886b411fd68010745e36bdcdba7e6f7a5315b0479b8d03e6dfe0183e7b1a8c2e260156714136dfa6294dd6763c149ea1ce58e13c9582e1f531be7d71b6

    Download Submit

  • memory/4840-0-0x0000000075750000-0x00000000757B0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/4840-1-0x0000000000F50000-0x0000000000F87000-memory.dmp

    Filesize

    220KB

    Download

  • memory/4840-2-0x0000000075750000-0x00000000757B0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/4840-3-0x0000000075750000-0x00000000757B0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/4840-4-0x00000000010B0000-0x00000000010BD000-memory.dmp

    Filesize

    52KB

    Download

  • memory/4840-7-0x0000000075750000-0x00000000757B0000-memory.dmp

    Filesize

    384KB

    Download