gozi | d231bc7187252a557d74954f1d6a0f77172121d80edbb0a2ef20e9dfdbda93a1

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.Win32.Zbot.yteu.exe
Size 482KB
Sample261016-dkrh4awtes
SHA256 d231bc7187252a557d74954f1d6a0f77172121d80edbb0a2ef20e9dfdbda93a1
MD5 c0cab7348e8e01510b930e8a9ce105c1
SHA1 a2dc27a762a5a1562359c265751a3d3bcd0c485d
SHA512 d1ceaaaaab2a2ee858cda83342dc41ae7f1a3240b7cb80d990088ac390839bc399ea4f9674fa6c236e6b5875348c87cccc1dd8fe0130f8cf18ad16f5b99b3c1e
SSDEEP 6144:tY9eHplLV3rdo8EobUFlbqQooK2YiUi+f1Azjm3F/ZT77Gt3E8vunX5Gg:S9wplB3ZoobIqvOsiUP33s3mX5Gg
TLSH
T1BCA4F122F590C470D01A2B3254A5CFE11E78BC7A5F34898F73E93A6DAEB06D1D97019B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker 1100 defense_evasion discovery execution gozi isfb persistence privilege_escalation trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1100

boombom.at/krp3cmg
hipohook.cn/krp3cmg
gumerhot.at/krp3cmg
voligon.cn/krp3cmg
joolpok.at/krp3cmg
nomopef.su/krp3cmg
xiloker.cn/krp3cmg
quihot.at/krp3cmg
joombok.su/krp3cmg
ribomoon.cn/krp3cmg
quartan.su/krp3cmg
chikoole.cn/krp3cmg

Attributes

build
214845
exe_type
worker
server_id
110

rsa_pubkey.plain

serpent.plain

Signatures

Family: Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4936	AppRgSup.exe

Executes dropped EXE 1 IoCs

pid	Process
4936	AppRgSup.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	20	208.67.222.222	1112	nslookup.exe
Destination IP	21	208.67.222.222	1112	nslookup.exe
Destination IP	19	208.67.222.222	1112	nslookup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\AarSuthz = "C:\\Users\\Admin\\AppData\\Roaming\\bcryispl\\AppRgSup.exe"	jaffacakes118_Trojan-Spy.Win32.Zbot.yteu.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4936 set thread context of 4996	4936	AppRgSup.exe	111
PID 4996 set thread context of 2032	4996	svchost.exe	80
PID 2032 set thread context of 4368	2032	explorer.exe	59
PID 2032 set thread context of 4436	2032	explorer.exe	60

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1108	cmd.exe
2512	cmd.exe
2520	cmd.exe
1944	cmd.exe
5860	cmd.exe
5976	cmd.exe
204	cmd.exe
236	cmd.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3248	4564	WerFault.exe	87
4988	4564	WerFault.exe	87
5948	4564	WerFault.exe	87
2524	4564	WerFault.exe	87
696	4564	WerFault.exe	87
4764	4564	WerFault.exe	87
5292	4936	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppRgSup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.Win32.Zbot.yteu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4936	AppRgSup.exe
4936	AppRgSup.exe
2032	explorer.exe
2032	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	explorer.exe

Suspicious behavior: MapViewOfSection 1 TTPs 4 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4936	AppRgSup.exe
4996	svchost.exe
2032	explorer.exe
2032	explorer.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2520	4564	jaffacakes118_Trojan-Spy.Win32.Zbot.yteu.exe	101
PID 2520 wrote to memory of 1944	2520	cmd.exe	105
PID 2520 wrote to memory of 5860	2520	cmd.exe	106
PID 2520 wrote to memory of 5976	2520	cmd.exe	107
PID 2520 wrote to memory of 204	2520	cmd.exe	108
PID 2520 wrote to memory of 236	2520	cmd.exe	109
PID 236 wrote to memory of 4936	236	cmd.exe	110
PID 4936 wrote to memory of 4996	4936	AppRgSup.exe	111
PID 4936 wrote to memory of 4996	4936	AppRgSup.exe	111
PID 4996 wrote to memory of 2032	4996	svchost.exe	80
PID 2032 wrote to memory of 4368	2032	explorer.exe	59
PID 2032 wrote to memory of 4436	2032	explorer.exe	60
PID 2032 wrote to memory of 1108	2032	explorer.exe	115
PID 1108 wrote to memory of 1112	1108	cmd.exe	117
PID 2032 wrote to memory of 2512	2032	explorer.exe	118

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4436

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Zbot.yteu.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Zbot.yteu.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 960
    3⤵
    - Program crash
    PID:3248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 1008
    3⤵
    - Program crash
    PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 1032
    3⤵
    - Program crash
    PID:5948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 1028
    3⤵
    - Program crash
    PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 1032
    3⤵
    - Program crash
    PID:696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3C98\1E4C.bat" "C:\Users\Admin\AppData\Roaming\bcryispl\AppRgSup.exe" "C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C ""C:\Users\Admin\AppData\Roaming\bcryispl\AppRgSup.exe" "C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE""
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1944
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C ""C:\Users\Admin\AppData\Roaming\bcryispl\AppRgSup.exe" "C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE""
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5860
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C ""C:\Users\Admin\AppData\Roaming\bcryispl\AppRgSup.exe" "C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE""
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5976
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C ""C:\Users\Admin\AppData\Roaming\bcryispl\AppRgSup.exe" "C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE""
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:204
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C ""C:\Users\Admin\AppData\Roaming\bcryispl\AppRgSup.exe" "C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE""
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:236
    - - C:\Users\Admin\AppData\Roaming\bcryispl\AppRgSup.exe
        
        "C:\Users\Admin\AppData\Roaming\bcryispl\AppRgSup.exe" "C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE"
        5⤵
        Deletes itself
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4936
      - C:\Windows\system32\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 184
        6⤵
        Program crash
        
        PID:5292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 184
    3⤵
    - Program crash
    PID:4764
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\C5E2.bi1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    - Unexpected DNS network traffic destination
    PID:1112
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C5E2.bi1"
  2⤵
  - Executes a command shell one-liner
  PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4564 -ip 4564
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4564 -ip 4564
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4564 -ip 4564
1⤵
PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4564 -ip 4564
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4564 -ip 4564
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4564 -ip 4564
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4936 -ip 4936
1⤵
PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1E4C.bat

Path C:\Users\Admin\AppData\Local\Temp\3C98\1E4C.bat
Size 112B
SHA256 855c66b67e0724398433b863284f0a81b5af259be4fc26a3263897ceb5f97f0f
MD5 b632404717976064c36d8306aace1fd1
SHA1 cf873aac4f290a525d0146eb4378c4c42fc0fc47
SHA512 eb9eb884b9e5e613fc779281f39561d8f4a74b3175e751c0515a62249b2e8c0308831ee5d8c0fb12ed90b7d1e03a60fe067a34e4a5f78fa14042ab9a51df19ce
TLSH
T1B7B092F82008B04A68A22888AE1E2850A61E4E8395AC6A99C476C0DE920F8180E4122B
MD5 SHA1 SHA512 TLSH

Submit Download

C5E2.bi1

Path C:\Users\Admin\AppData\Local\Temp\C5E2.bi1
Size 120B
SHA256 368bbb25fe2fc8b99a49b3cc093d759bbd3bb82f899dfd9dc79b0df1de9d3af5
MD5 b24fc119f8442c07f43d6476f2c602a0
SHA1 8fda5fcdb1df96eb147249aaad0361018acb4a78
SHA512 da62c8d6bfb258b6f329816a087d30f7d9e2bdba2e68280d2a322fe1ec9317c5192f08a6dd63a990c2c8c5ad2a902ac022c7e0b96397d54e602022471463ea4a
TLSH
T1F5B09235AF1BE05456C0C1BD25D0A230964512F944C994B034ED80AB26E0AF82F9E00C
MD5 SHA1 SHA512 TLSH

Submit Download

AppRgSup.exe

Path C:\Users\Admin\AppData\Roaming\bcryispl\AppRgSup.exe
Size 482KB
SHA256 d231bc7187252a557d74954f1d6a0f77172121d80edbb0a2ef20e9dfdbda93a1
MD5 c0cab7348e8e01510b930e8a9ce105c1
SHA1 a2dc27a762a5a1562359c265751a3d3bcd0c485d
SHA512 d1ceaaaaab2a2ee858cda83342dc41ae7f1a3240b7cb80d990088ac390839bc399ea4f9674fa6c236e6b5875348c87cccc1dd8fe0130f8cf18ad16f5b99b3c1e
SSDEEP 6144:tY9eHplLV3rdo8EobUFlbqQooK2YiUi+f1Azjm3F/ZT77Gt3E8vunX5Gg:S9wplB3ZoobIqvOsiUP33s3mX5Gg
TLSH
T1BCA4F122F590C470D01A2B3254A5CFE11E78BC7A5F34898F73E93A6DAEB06D1D97019B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2032-50-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Download

memory/2032-35-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Download

memory/2032-84-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Download

memory/2032-83-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Download

memory/2032-82-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Download

memory/2032-80-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Download

memory/2032-75-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Download

memory/2032-51-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Download

memory/2032-53-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Download

memory/2032-52-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Download

memory/2032-43-0x0000000003F00000-0x0000000003F8F000-memory.dmp

Download

memory/4368-49-0x00000261056B0000-0x000002610573F000-memory.dmp

Download

memory/4368-45-0x00000261056B0000-0x000002610573F000-memory.dmp

Download

memory/4436-58-0x000001A7FBEF0000-0x000001A7FBF7F000-memory.dmp

Download

memory/4436-54-0x000001A7FBEF0000-0x000001A7FBF7F000-memory.dmp

Download

memory/4564-1-0x0000000000620000-0x0000000000621000-memory.dmp

Download

memory/4564-4-0x0000000000620000-0x0000000000621000-memory.dmp

Download

memory/4564-5-0x0000000002800000-0x00000000028AA000-memory.dmp

Download

memory/4564-0-0x0000000002800000-0x00000000028AA000-memory.dmp

Download

memory/4564-6-0x0000000000620000-0x0000000000621000-memory.dmp

Download

memory/4564-20-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4564-7-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4564-11-0x0000000000620000-0x0000000000621000-memory.dmp

Download

memory/4564-2-0x0000000000620000-0x0000000000621000-memory.dmp

Download

memory/4564-3-0x0000000000620000-0x0000000000621000-memory.dmp

Download

memory/4936-24-0x00000000021F0000-0x00000000021F1000-memory.dmp

Download

memory/4936-25-0x00000000021F0000-0x00000000021F1000-memory.dmp

Download

memory/4936-59-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4936-27-0x0000000002430000-0x00000000024DA000-memory.dmp

Download

memory/4936-26-0x00000000021F0000-0x00000000021F1000-memory.dmp

Download

memory/4936-22-0x0000000002430000-0x00000000024DA000-memory.dmp

Download

memory/4936-23-0x00000000021F0000-0x00000000021F1000-memory.dmp

Download

memory/4996-36-0x0000000000E40000-0x0000000000ECF000-memory.dmp

Download

memory/4996-31-0x0000000000E40000-0x0000000000ECF000-memory.dmp

Download