gozi_ifsb | 9c51cbe4681facc34623aeca27a18dbaa6db1337990a0e003b7c9babeb06c1eb

Analysis

Target
yytr.png.dll
Size 463KB
Sample210211-3ttsec2j32
SHA256 9c51cbe4681facc34623aeca27a18dbaa6db1337990a0e003b7c9babeb06c1eb
MD5 ba2befa9c70c2b6d779c48a59cece3e5
SHA1 4c855f80076e357d35c7d60cd52d2c49abefc5ff
SHA512 bdc4e33de9de4cf27d1df05e22163c6a3ef0d2406d80cb51db34139bf08cc3a923b079686fbc0a1b359ee46447eb0583c3343360d7e755179e9661c4a503047e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.base64

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4272	4788	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 15 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4788	4764	rundll32.exe	23
PID 4764 wrote to memory of 4788	4764	rundll32.exe	23
PID 4764 wrote to memory of 4788	4764	rundll32.exe	23

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\yytr.png.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\yytr.png.dll,#1
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 732
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4272

memory/4272-7-0x0000000003FF0000-0x0000000003FF1000-memory.dmp

Download

memory/4788-3-0x0000000003FC1000-0x0000000004019000-memory.dmp

Download

memory/4788-5-0x00000000005A0000-0x00000000005AD000-memory.dmp

Download

memory/4788-4-0x0000000000590000-0x0000000000591000-memory.dmp

Download

memory/4788-6-0x0000000000B70000-0x0000000000B7F000-memory.dmp

Download