gozi_ifsb | b553c5b6da9f88cfc7d00fba468abef8d2b7889f5f19b70e6c52a091f9854121 | Triage

Analysis

max time kernel
87s
max time network
135s
platform
windows10_x64
resource
win10v20210410
submitted
21-04-2021 09:06

Sharing

Report Analysis Logs

General

Target

27851.png.dll
Size

486KB
MD5

0b26191e482cf7c321efeb8d2569caac
SHA1

0909177f5f88f101146bb4e31202ad92ebd8e223
SHA256

b553c5b6da9f88cfc7d00fba468abef8d2b7889f5f19b70e6c52a091f9854121
SHA512

169256f7cb7bfea1a151ac927b57f77d0b513038cea9232040bdec773faa3b92e4522324ab62ed8ea5a8c54293d0d5e1638ef01a88fbb316cd010f145bb85099

Score

10^/10

gozi_ifsb 4460 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

4460

C2

1.microsoft.com

horulenuke.us

vorulenuke.us

Attributes

build
250190
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
12

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3944 wrote to memory of 4076	3944	rundll32.exe	rundll32.exe
PID 3944 wrote to memory of 4076	3944	rundll32.exe	rundll32.exe
PID 3944 wrote to memory of 4076	3944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27851.png.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27851.png.dll,#1
2⤵
PID:4076

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4076-114-0x0000000000000000-mapping.dmp

Download
memory/4076-116-0x0000000073640000-0x00000000736D4000-memory.dmp

Filesize
592KB

Download
memory/4076-115-0x0000000073640000-0x000000007364F000-memory.dmp

Filesize
60KB

Download
memory/4076-117-0x0000000000720000-0x000000000086A000-memory.dmp

Filesize
1.3MB

Download