Overview

overview

10

Static

static

3

07a73fb70f...a2.dll

windows7-x64

10

07a73fb70f...a2.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2025, 19:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    07a73fb70fa63ff53d091c68cb1e5728314ff7b479ca695050173faf3f8f5ea2.dll

  • Size

    119KB

  • MD5

    c8392d93a1f064a53abb61887cad409b

  • SHA1

    20c77abcc1e3904bf337af924200d63aaa012b1b

  • SHA256

    07a73fb70fa63ff53d091c68cb1e5728314ff7b479ca695050173faf3f8f5ea2

  • SHA512

    1b677b00d7db9266a9c05f653e3dcbacd6a9ff29fa84ffcc64775b1e200618b73ca142de333116194e2937bebcd9a7008fd2112fb615cfac459c2973bcb625a8

  • SSDEEP

    3072:3VtPSsu5yds0ZCzsRqojgfwE3DCW/5z5TCXq:lUT5yd3ZCXfIQR95Tf

Score
10/10
gozi7242bankerdiscoveryisfbtrojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7242

C2

web.vortex.data.microsoft.com

ocsp.sca1b.amazontrust.com

settingsline.com
Attributes
  • build

    250162

  • dns_servers

    107.174.86.134

    107.175.127.22

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Gozi family
    gozi
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 63 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\07a73fb70fa63ff53d091c68cb1e5728314ff7b479ca695050173faf3f8f5ea2.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\07a73fb70fa63ff53d091c68cb1e5728314ff7b479ca695050173faf3f8f5ea2.dll
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4744
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1520
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3180
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3180 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2484
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5016 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4148
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4832 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2108
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
    Filesize

    471B

    MD5

    4a326b4601ab30dfcfec12796d4473af

    SHA1

    fcc8ab255f002787a2f4756a6e7aaebc4ca0b5ff

    SHA256

    58c3470bcc9b953996e86f7741d7a6b1afe327c1c65788c2ef262c1beb6df10c

    SHA512

    2462008010263772ed24dbf2e6b9c002e29334c7529ddbc5f8272dbb41d5eb54dcc9556ade4dab79f32a10cdff67520882a5505f80dd23a752ea69407afd654e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
    Filesize

    412B

    MD5

    6a32bf915bceecdc3b1812417571abee

    SHA1

    f2c41b4cf7816ffa46da5bf024967da4f74d01cf

    SHA256

    a5e419cba47bc95ba558ec857f60578b0884e41c1f21c2c5a068f24cba05bf44

    SHA512

    1d5fccd9f88afe525e46a3367efa37a987312a45c6a282912967fe5fe0bbfece27faef9f93f3d1d21290e5459c5ab9d673fc6543dfdae5d23cb7afe1d2dd4e52

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\~DF79FE3C40F8B09F30.TMP
    Filesize

    16KB

    MD5

    f75ac5f1644bb668342b5ef6e3089058

    SHA1

    845b155a76de1f46a5ed344d48513278e854e8d5

    SHA256

    095acfd9667a479e1a430d82762e2164649d27d835340bdb66c913ec32646160

    SHA512

    abd56f9d9e8dc1fc6a72a9a379a26652d7ecc686dabea0b8806a1d64266b6c4bea39bf734e2a30ad467b43068a9ff62842ad31e08e9944ac021a41faa5199cce

    Download Submit

  • memory/4744-0-0x00000000004D0000-0x00000000004F5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/4744-1-0x00000000004D1000-0x00000000004D2000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4744-2-0x00000000004D0000-0x00000000004F5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/4744-3-0x00000000004D0000-0x00000000004F5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/4744-4-0x00000000007C0000-0x00000000007D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4744-14-0x00000000004D1000-0x00000000004D2000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4744-15-0x00000000004D0000-0x00000000004F5000-memory.dmp

    Filesize

    148KB

    Download