Trojan.Gozi.2852

Техническая информация

Отработавшее пользовательское сигма правило:

92626ddd-662c-49e3-ac59-f6535f12d189
81325ce1-be01-4250-944f-b4789644556f
7a02e22e-b885-4404-b38b-1ddc7e65258a
f4bbd493-b796-416e-bbf2-121235348529
87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\windowsthemeservice

Вредоносные функции

Внедряет код в

следующие пользовательские процессы:

setup.exe

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cmd.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nsq2bf5.tmp
%TEMP%\nsf2c05.tmp\system.dll
%LOCALAPPDATA%\programs\setup\license.electron.txt
%LOCALAPPDATA%\programs\setup\licenses.chromium.html
%LOCALAPPDATA%\programs\setup\chrome_100_percent.pak
%LOCALAPPDATA%\programs\setup\chrome_200_percent.pak
%LOCALAPPDATA%\programs\setup\d3dcompiler_47.dll
%LOCALAPPDATA%\programs\setup\dxcompiler.dll
%LOCALAPPDATA%\programs\setup\dxil.dll
%LOCALAPPDATA%\programs\setup\ffmpeg.dll
%LOCALAPPDATA%\programs\setup\icudtl.dat
%LOCALAPPDATA%\programs\setup\libegl.dll
%LOCALAPPDATA%\programs\setup\libglesv2.dll
%LOCALAPPDATA%\programs\setup\resources.pak
%LOCALAPPDATA%\programs\setup\setup.exe
%LOCALAPPDATA%\programs\setup\snapshot_blob.bin
%LOCALAPPDATA%\programs\setup\v8_context_snapshot.bin
%LOCALAPPDATA%\programs\setup\vk_swiftshader.dll
%LOCALAPPDATA%\programs\setup\vk_swiftshader_icd.json
%LOCALAPPDATA%\programs\setup\vulkan-1.dll
%LOCALAPPDATA%\programs\setup\locales\af.pak
%LOCALAPPDATA%\programs\setup\locales\am.pak
%LOCALAPPDATA%\programs\setup\locales\ar.pak
%LOCALAPPDATA%\programs\setup\locales\bg.pak
%LOCALAPPDATA%\programs\setup\locales\bn.pak
%LOCALAPPDATA%\programs\setup\locales\ca.pak
%LOCALAPPDATA%\programs\setup\locales\cs.pak
%LOCALAPPDATA%\programs\setup\locales\da.pak
%LOCALAPPDATA%\programs\setup\locales\de.pak
%LOCALAPPDATA%\programs\setup\locales\el.pak
%LOCALAPPDATA%\programs\setup\locales\en-gb.pak
%LOCALAPPDATA%\programs\setup\locales\en-us.pak
%LOCALAPPDATA%\programs\setup\locales\es-419.pak
%LOCALAPPDATA%\programs\setup\locales\es.pak
%LOCALAPPDATA%\programs\setup\locales\et.pak
%LOCALAPPDATA%\programs\setup\locales\fa.pak
%LOCALAPPDATA%\programs\setup\locales\fi.pak
%LOCALAPPDATA%\programs\setup\locales\fil.pak
%LOCALAPPDATA%\programs\setup\locales\fr.pak
%LOCALAPPDATA%\programs\setup\locales\gu.pak
%LOCALAPPDATA%\programs\setup\locales\he.pak
%LOCALAPPDATA%\programs\setup\locales\hi.pak
%LOCALAPPDATA%\programs\setup\locales\hr.pak
%LOCALAPPDATA%\programs\setup\locales\hu.pak
%LOCALAPPDATA%\programs\setup\locales\id.pak
%LOCALAPPDATA%\programs\setup\locales\it.pak
%LOCALAPPDATA%\programs\setup\locales\ja.pak
%LOCALAPPDATA%\programs\setup\locales\kn.pak
%LOCALAPPDATA%\programs\setup\locales\ko.pak
%LOCALAPPDATA%\programs\setup\locales\lt.pak
%LOCALAPPDATA%\programs\setup\locales\lv.pak
%LOCALAPPDATA%\programs\setup\locales\ml.pak
%LOCALAPPDATA%\programs\setup\locales\mr.pak
%LOCALAPPDATA%\programs\setup\locales\ms.pak
%LOCALAPPDATA%\programs\setup\locales\nb.pak
%LOCALAPPDATA%\programs\setup\locales\nl.pak
%LOCALAPPDATA%\programs\setup\locales\pl.pak
%LOCALAPPDATA%\programs\setup\locales\pt-br.pak
%LOCALAPPDATA%\programs\setup\locales\pt-pt.pak
%LOCALAPPDATA%\programs\setup\locales\ro.pak
%LOCALAPPDATA%\programs\setup\locales\ru.pak
%LOCALAPPDATA%\programs\setup\locales\sk.pak
%LOCALAPPDATA%\programs\setup\locales\sl.pak
%LOCALAPPDATA%\programs\setup\locales\sr.pak
%LOCALAPPDATA%\programs\setup\locales\sv.pak
%LOCALAPPDATA%\programs\setup\locales\sw.pak
%LOCALAPPDATA%\programs\setup\locales\ta.pak
%LOCALAPPDATA%\programs\setup\locales\te.pak
%LOCALAPPDATA%\programs\setup\locales\th.pak
%LOCALAPPDATA%\programs\setup\locales\tr.pak
%LOCALAPPDATA%\programs\setup\locales\uk.pak
%LOCALAPPDATA%\programs\setup\locales\ur.pak
%LOCALAPPDATA%\programs\setup\locales\vi.pak
%LOCALAPPDATA%\programs\setup\locales\zh-cn.pak
%LOCALAPPDATA%\programs\setup\locales\zh-tw.pak
%LOCALAPPDATA%\programs\setup\resources\app.asar
%LOCALAPPDATA%\programs\setup\resources\app.asar.unpacked\output.js
%LOCALAPPDATA%\programs\setup\<Имя файла>.exe
%TEMP%\nsf2c05.tmp\nsexec.dll

Другое

Ищет следующие окна

ClassName: '#32770' WindowName: ''
ClassName: 'SysListView32' WindowName: ''

Создает и запускает на исполнение

'%LOCALAPPDATA%\programs\setup\setup.exe'
'%LOCALAPPDATA%\programs\setup\setup.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\setup" --field-trial-handle=1680,i,6162903610463137280,8282783...
'%LOCALAPPDATA%\programs\setup\setup.exe' --type=gpu-process --user-data-dir="%APPDATA%\setup" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== -...

Запускает на исполнение

'%WINDIR%\syswow64\schtasks.exe' /create /tn "WindowsThemeService" /tr "\"%LOCALAPPDATA%\Programs\setup\setup.exe\"" /sc onlogon /rl highest /f (со скрытым окном)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"" (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"