Overview

overview

10

Static

static

gozi (1).bin.dll

windows7_x64

10

gozi (1).bin.dll

windows10_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    07/07/2020, 09:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    gozi (1).bin.dll

  • Size

    231KB

  • MD5

    a23a634785b4c2aed3ceaf90290af0c8

  • SHA1

    a528c660f15806c967eb66b4cc0ff5547ba32405

  • SHA256

    8116f086d5b222ea6d3ac385bbc8f3a88c19f920435e1ba274a1f46702ab10a2

  • SHA512

    62763456b8e252448b1f6dfc376c64514e212881bbf0f558722cea18883a916c5725c41b488d4b5df7ad4f584eb9ee47c1beb98ae5325e55da864ed5d2094222

Score
10/10
bankertrojangozi_ifsb

Malware Config

Signatures

  • Checks whether UAC is enabled 8 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 87 IoCs
    adwarespyware
  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gozi (1).bin.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:716
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gozi (1).bin.dll",#1
      2⤵
        PID:344
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      PID:3932
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3932 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        • Modifies Internet Explorer settings
        PID:3892
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      PID:1464
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        PID:1752
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      PID:2668
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of AdjustPrivilegeToken
        • Modifies Internet Explorer settings
        PID:2996
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      PID:1148
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        • Modifies Internet Explorer settings
        PID:2244

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2996-6-0x000000000C010000-0x000000000C020000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2996-7-0x000000000C010000-0x000000000C020000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2996-8-0x000000000BF10000-0x000000000BF20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2996-9-0x000000000BF10000-0x000000000BF20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2996-10-0x000000000C010000-0x000000000C020000-memory.dmp

      Filesize

      64KB

      Download