gozi_ifsb | 8df914f790a6e5eb07042cce36ea9a23e23cdc1610d930f306f9ef55b6d8a2c5

Analysis

max time kernel
6s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
10/02/2021, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
footer.jpg.dll
Size 286KB
Sample210210-1m263rm71e
SHA256 8df914f790a6e5eb07042cce36ea9a23e23cdc1610d930f306f9ef55b6d8a2c5
MD5 9df5fcca1aadec6333301aca7a13c481
SHA1 f3445c636e0a702eff7782b9e8eeb4ca84f842ff
SHA512 c1bb8d9ce6f014cc6c1dd68e767c03bbc4d56875f792d2f994f5740ad2d23ab75d3caa9b9d9778fab903685db4f87c1b999756e5b3a971dec1a405cad5ac17ad
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 7251 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

7251

web.vortex.data.microsoft.com
ocsp.sca1b.amazontrust.com
nerowins.com

Attributes

build
250177
dns_servers
107.174.86.134

107.175.127.22
exe_type
loader

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1072	1832	regsvr32.exe	25
PID 1832 wrote to memory of 1072	1832	regsvr32.exe	25
PID 1832 wrote to memory of 1072	1832	regsvr32.exe	25
PID 1832 wrote to memory of 1072	1832	regsvr32.exe	25
PID 1832 wrote to memory of 1072	1832	regsvr32.exe	25
PID 1832 wrote to memory of 1072	1832	regsvr32.exe	25
PID 1832 wrote to memory of 1072	1832	regsvr32.exe	25

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\footer.jpg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\footer.jpg.dll
  2⤵
  PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-4-0x0000000076191000-0x0000000076193000-memory.dmp

Download

memory/1072-5-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

memory/1072-6-0x0000000000270000-0x00000000002E7000-memory.dmp

Download

memory/1832-2-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads