gozi_ifsb | f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b

Analysis

Target

f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b.dll
Size

196KB
MD5

110f8f96a6313b9a11e81edcab961454
SHA1

547e68948b7c490bb0793f5d123b606d1d5f6210
SHA256

f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b
SHA512

02bfa696131c5b57d10f9cff4ee34f3c412bae53a13f57d800ce0e3ab046e10fbde2d22210ec9de27ef092bf59f45231edef6fdd157437f4c024e35b4edcee94

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1868 4784 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1868	4784	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1868 WerFault.exe
Token: SeBackupPrivilege 1868 WerFault.exe
Token: SeDebugPrivilege 1868 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4768 wrote to memory of 4784	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 4784	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 4784	4768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f18fa78f01e930c099b0a1dab86ca4151ffbb265a741135dcff80791cc2fa18b.dll,#1
2⤵
PID:4784

memory/1868-4-0x0000000004730000-0x0000000004731000-memory.dmp

Filesize
4KB

Download
memory/1868-8-0x0000000004A70000-0x0000000004A71000-memory.dmp

Filesize
4KB

Download
memory/4784-2-0x0000000000000000-mapping.dmp

Download
memory/4784-3-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/4784-5-0x0000000000000000-mapping.dmp

Download
memory/4784-6-0x0000000000000000-mapping.dmp

Download
memory/4784-7-0x0000000000000000-mapping.dmp

Download