gozi_rm3 | f7c79c0c3feb7c0032424f5f6a9bcdf78d1815ee53f807cc192c2c1f8f21270f

Analysis

Target

ioir.png.dll
Size

539KB
MD5

d31c0491f522d6b9f2102109bd2420af
SHA1

dc1cccf0e43ec5a68326ae4faf1a8cbc5ac00708
SHA256

f7c79c0c3feb7c0032424f5f6a9bcdf78d1815ee53f807cc192c2c1f8f21270f
SHA512

48d659660654800da4eb3909a06572dfcf5f05ebdfb8629fafdfeab601673e3377d9a3a241f4bd36c3f4f912ac838dbc73926f734bfa8a76ec43fa726b28c3bd

Score

10^/10

Family

gozi_rm3

Botnet

201193207

https://topitophug.xyz

Attributes

rsa_pubkey.base64

serpent.plain

Gozi RM3
A heavily modified version of Gozi using RM3 loader.
banker trojan gozi_rm3

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	3704	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 3704	3888	rundll32.exe	71
PID 3888 wrote to memory of 3704	3888	rundll32.exe	71
PID 3888 wrote to memory of 3704	3888	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ioir.png.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ioir.png.dll,#1
  2⤵
  PID:3704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 724
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2528

memory/2528-5-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/3704-3-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/3704-4-0x0000000004700000-0x0000000004712000-memory.dmp

Filesize
72KB

Download
memory/3704-6-0x0000000004610000-0x000000000461E000-memory.dmp

Filesize
56KB

Download
memory/3704-7-0x0000000004630000-0x0000000004640000-memory.dmp

Filesize
64KB

Download