gozi | 6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
Size

6.6MB
MD5

eaf6740c663da9601f344b83b7f67c74
SHA1

0ec03a37d8406969b2215ee351aa5a039b624452
SHA256

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e
SHA512

0e9c4a56dcdf8224662a1b7bb766115c89a359b7f26ea65d50705455834e75ee558c00ef3eb9c793048232c39d8934a59e279a1cb33cb7a4924572467fcba906
SSDEEP

98304:aq6XGhO7xQ80++bn601e5D11xZzs/F2RHQy+/9WoaTXN7vA:aqR2ubA5D11U/IwPapA

Score

10^/10

gozi banker isfb trojan upx

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2140-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-14-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-16-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-10-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2140-7-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

pid process

2140 6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

pid process

2140 6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

pid process

2140 6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

description	pid	process
Token: SeDebugPrivilege	2140	6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
Token: SeDebugPrivilege	2140	6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

pid	process
2140	6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
2140	6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
2140	6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

C:\Users\Admin\AppData\Local\Temp\6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
"C:\Users\Admin\AppData\Local\Temp\6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2140

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2140-0-0x0000000000695000-0x00000000008BD000-memory.dmp

Filesize
2.2MB

Download
memory/2140-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2140-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2140-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2140-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-28-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-26-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-24-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-63-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-62-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-20-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-14-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-64-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-65-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-67-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-69-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-70-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-68-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-66-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-16-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-10-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-6-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-7-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2140-71-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-72-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-74-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-76-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-77-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-79-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-80-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-78-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-75-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-73-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2140-81-0x0000000000695000-0x00000000008BD000-memory.dmp

Filesize
2.2MB

Download
memory/2140-82-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads