Overview

overview

10

Static

static

3

a4db77d838...18.exe

windows7-x64

10

a4db77d838...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 09:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a4db77d838edb48296656263e4195d6a_JaffaCakes118.exe

  • Size

    203KB

  • MD5

    a4db77d838edb48296656263e4195d6a

  • SHA1

    a83f759e9d47b798a3b35f0b12340b9c1d215430

  • SHA256

    928ed10619e31e294434cb2d95f8e0ade1fa830cf60357fba27de3fc969ff522

  • SHA512

    68e835495caf4d749637e0aa74c5b1cc6991d9c88159742b928e1673268a17b2a7c16ceb47b88c881a202bab2370a88e7a9a612f16177cb6adb901b005bb2616

  • SSDEEP

    3072:9Hji2dQ6v4uPXDNUj4jKBonzmLXlYVRLh0epEEZqkFBc4+uTqN76o:9Ldp4uPZzGonqXGXh0bluBc4GZ5

Score
10/10
gozi3162bankerisfbtrojan

Malware Config

Extracted

Family

gozi

Attributes
  • build

    215165

Extracted

Family

gozi

Botnet

3162

C2

menehleibe.com

liemuteste.com

thulligend.com
Attributes
  • build

    215165

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4db77d838edb48296656263e4195d6a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a4db77d838edb48296656263e4195d6a_JaffaCakes118.exe"
    1⤵
      PID:392
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:2224
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2456
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4484
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3660 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:412
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:552
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:552 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2216

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\~DF6A2A8FC902A632FF.TMP
        Filesize

        16KB

        MD5

        7c6c6cff925fd2783bc9e303fa86023a

        SHA1

        0d4880c7eb02b20968f838c1bc5adb4a0a807b17

        SHA256

        cf54d98a0062e7ea7e73c7d542c5a76a37d0eaa4e4338ae0fd4432983d95bfbb

        SHA512

        8788d6ac541edca8732ce830d90b39fd40ed0194bbe1afa08af1bdbd79abb7db965c622f63a0a43e348451f788f3eeec292e60657b6de96a079b504e9860347d

        Download Submit
      • memory/392-0-0x0000000000400000-0x000000000043F000-memory.dmp
        Filesize

        252KB

        Download
      • memory/392-1-0x0000000000400000-0x000000000043F000-memory.dmp
        Filesize

        252KB

        Download
      • memory/392-3-0x0000000000400000-0x000000000043F000-memory.dmp
        Filesize

        252KB

        Download
      • memory/392-2-0x0000000000435000-0x000000000043A000-memory.dmp
        Filesize

        20KB

        Download
      • memory/392-4-0x00000000007F0000-0x000000000080B000-memory.dmp
        Filesize

        108KB

        Download