Analysis
-
max time kernel
129s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
06/03/2025, 14:38
General
-
Target
60ec9838522ebad66ab2ff8a9f95b46a1e2fcbfa69f2b3def374f02d588ce7c3.exe
-
Size
2.5MB
-
MD5
0758c0a8e2bc20e97be44abf8807cc7b
-
SHA1
2527e503520ae7f38370f9d72f83a80263556c72
-
SHA256
60ec9838522ebad66ab2ff8a9f95b46a1e2fcbfa69f2b3def374f02d588ce7c3
-
SHA512
2411c1ec1c30369cd52d09c0b7b6f64fa698b21d3ac34da5915d90e40c9e7b92dc22427662c373b06986991dae7fb631ab4eb6e7f021c5b717f11dc69c0978c9
-
SSDEEP
49152:yDHRbmQanLWGS0V67X1KwwoWBJUP1jPcDibBUrvje5tfJ4kLlJa09oi+lnME:yDHRbmQyWPr1LMBWP1jPcDFeN1Llr95F
Malware Config
Extracted
gozi
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 37 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60ec9838522ebad66ab2ff8a9f95b46a1e2fcbfa69f2b3def374f02d588ce7c3.exe"C:\Users\Admin\AppData\Local\Temp\60ec9838522ebad66ab2ff8a9f95b46a1e2fcbfa69f2b3def374f02d588ce7c3.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\updata.exeC:\Users\Admin\AppData\Local\Temp/updata.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5637c0d32e43d4017e252cfcd6239c38e
SHA13099b09a540c64e0b4f4b52ba9ee9ee485ed9054
SHA256e50a14c5ac46b40337cf1af741ac0c69eb586bd4f51a3f0e512eec9a0354b2e0
SHA5126ddca14e8adf2101d7a1f7d9c5d7b0292e64cc5e86a54fc086594399cbf778bef54e609c88230d4ce46bd72f27a76602a27226a94795648d600c41f1023e877e
-
Filesize
1.0MB
MD53ba9c16dba6bc685797f6cfcf2f18728
SHA1d4bff0bd9d07204327ecf0278c125feae7b13fb5
SHA2568c0707c77cedbd3a751dae99bd8c38ccca1ea03b2559a3fcd0c8b69282c067dc
SHA512220bc210921618f8adb8a87b83e564d127581fcacfdfa7d422996a4994203e06c0f8a457c50efa753f0e1d307f81f1833929c9c0223083f04e4ff78a27a1995c
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
7.9MB
-
Filesize
248KB
-
Filesize
2.8MB
-
Filesize
7.9MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
2.8MB
-
Filesize
248KB
-
Filesize
7.9MB
-
Filesize
12KB
-
Filesize
64KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
2.8MB
-
Filesize
5.0MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB