gozi | 6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e

Analysis

max time kernel
135s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
Size

6.6MB
MD5

eaf6740c663da9601f344b83b7f67c74
SHA1

0ec03a37d8406969b2215ee351aa5a039b624452
SHA256

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e
SHA512

0e9c4a56dcdf8224662a1b7bb766115c89a359b7f26ea65d50705455834e75ee558c00ef3eb9c793048232c39d8934a59e279a1cb33cb7a4924572467fcba906
SSDEEP

98304:aq6XGhO7xQ80++bn601e5D11xZzs/F2RHQy+/9WoaTXN7vA:aqR2ubA5D11U/IwPapA

Score

10^/10

gozi banker isfb trojan upx

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3284-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-35-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-6-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-33-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3284-8-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

pid process

3284 6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

pid process

3284 6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
3284 6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

description	pid	process
Token: SeDebugPrivilege	3284	6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
Token: SeDebugPrivilege	3284	6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

pid	process
3284	6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
3284	6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
3284	6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe

C:\Users\Admin\AppData\Local\Temp\6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe
"C:\Users\Admin\AppData\Local\Temp\6cf5d332496415658a86d4de12387c58e076f05aff2dbd5fba51dd165f18407e.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3284-0-0x0000000000695000-0x00000000008BD000-memory.dmp

Filesize
2.2MB

Download
memory/3284-1-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/3284-2-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-35-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-6-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-56-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-60-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-33-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-8-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3284-7-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-61-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-62-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-63-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-64-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-65-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-66-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-67-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-68-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-69-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-70-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/3284-71-0x0000000000695000-0x00000000008BD000-memory.dmp

Filesize
2.2MB

Download
memory/3284-72-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download