Unwrapping Ursnifs Gifts - The DFIR Report

Testo acquisito dalla fonte

Evento MISP pubblicato con TLP:CLEAR: Unwrapping Ursnifs Gifts - The DFIR Report. Report from raw HTML https:// Skip to content In late @[tag](misp-galaxy:tool="August") 2022, we investigated an incident involving @[tag](misp-galaxy:banker="Gozi") malware, which resulted in @[tag](misp-galaxy:malpedia="Cobalt Strike") being deployed. This was followed by the threat actors moving laterally throughout the environment using an admin account. The @[tag](misp-galaxy:banker="Gozi") malware family (also commonly referred to as @[tag](misp-galaxy:banker="Gozi") or ISFB) is one of the oldest banking trojans still active today. It has an extensive past of code forks and evolutions that has lead to several active variants in the last 5 years including Dreambot, IAP, RM2, RM3 and most recently, LDR4. For this report, we have referred to the malware as @[tag](misp-galaxy:banker="Gozi") for simplicity, however we also recommend reading Mandiant’s article on LDR4. ## Case Summary In this intrusion, a malicious ISO file was delivered to a user which contained @[tag](misp-galaxy:banker="Gozi") malware. The malware displayed an interesting execution flow, which included using a renamed copy of rundll32. Once executed, the malware conducted automatic discovery on the beachhead host, as we have observed with other loaders such as IcedID. The malware also established persistence on the host with the creation of a registry run key. Approximately 4 days after the initial infection