gozi_ifsb | f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b

Analysis

Target

f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b.dll
Size

196KB
MD5

110f8f96a6313b9a11e81edcab961454
SHA1

547e68948b7c490bb0793f5d123b606d1d5f6210
SHA256

f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b
SHA512

02bfa696131c5b57d10f9cff4ee34f3c412bae53a13f57d800ce0e3ab046e10fbde2d22210ec9de27ef092bf59f45231edef6fdd157437f4c024e35b4edcee94

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1824 1636 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1824 WerFault.exe
1824 WerFault.exe
1824 WerFault.exe
1824 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1824 WerFault.exe

pid	pid_target	process	target process
1824	1636	WerFault.exe	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1824	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 548 wrote to memory of 1636	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 1636	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 1636	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 1636	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 1636	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 1636	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 1636	548	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1824	1636	rundll32.exe	WerFault.exe
PID 1636 wrote to memory of 1824	1636	rundll32.exe	WerFault.exe
PID 1636 wrote to memory of 1824	1636	rundll32.exe	WerFault.exe
PID 1636 wrote to memory of 1824	1636	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1636

memory/1636-2-0x0000000000000000-mapping.dmp

Download
memory/1636-3-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/1636-7-0x0000000000000000-mapping.dmp

Download
memory/1636-6-0x0000000000000000-mapping.dmp

Download
memory/1636-8-0x0000000000000000-mapping.dmp

Download
memory/1824-4-0x0000000000000000-mapping.dmp

Download
memory/1824-5-0x0000000001FA0000-0x0000000001FB1000-memory.dmp

Filesize
68KB

Download
memory/1824-9-0x0000000002460000-0x0000000002471000-memory.dmp

Filesize
68KB

Download