gozi_ifsb | f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b

Analysis

Target
f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b.dll
Size 196KB
Sample201208-gqc8bqhan6
SHA256 f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b
MD5 110f8f96a6313b9a11e81edcab961454
SHA1 547e68948b7c490bb0793f5d123b606d1d5f6210
SHA512 02bfa696131c5b57d10f9cff4ee34f3c412bae53a13f57d800ce0e3ab046e10fbde2d22210ec9de27ef092bf59f45231edef6fdd157437f4c024e35b4edcee94
MD5 SHA1 SHA512

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	4784	WerFault.exe	57

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4784	4768	rundll32.exe	57
PID 4768 wrote to memory of 4784	4768	rundll32.exe	57
PID 4768 wrote to memory of 4784	4768	rundll32.exe	57

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b.dll,#1
  2⤵
  PID:4784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 688
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1868

memory/1868-4-0x0000000004730000-0x0000000004731000-memory.dmp

Download

memory/1868-8-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download

memory/4784-3-0x0000000010000000-0x0000000010034000-memory.dmp

Download