gozi_ifsb | d8f3fedde975e393530b694eee1ef9c981b48bc46b4e24749c20189a6fa58e79 | Triage

Analysis

max time kernel
38s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
18-02-2021 19:50

Sharing

Report Analysis Logs

General

Target

202102121641_8600b6aff4ee95d4f78e5dc77f66af3c07241db926b053144943361bc64c37f7.bin.dll
Size

216KB
MD5

06ddae0e67a048aff8829413a7903bec
SHA1

aee60f4e070f845183b59f16dad84a72733e4d0a
SHA256

8600b6aff4ee95d4f78e5dc77f66af3c07241db926b053144943361bc64c37f7
SHA512

8dbecf12c003a996f4f41e9e087531a3c6e1572aaf6f4e6e0538d155febb3c5b20fe8cf0b267716091f5db656a95d5de9254fc911056883380589863d899e1bd

Score

10^/10

gozi_ifsb 2200 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

2200

C2

api10.laptok.at/api1

golang.feel500.at/api1

go.in100k.at/api1

Attributes

build
250171
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com
ru
org
exe_type
loader
server_id
730

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3116 wrote to memory of 364	3116	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 364	3116	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 364	3116	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\202102121641_8600b6aff4ee95d4f78e5dc77f66af3c07241db926b053144943361bc64c37f7.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\202102121641_8600b6aff4ee95d4f78e5dc77f66af3c07241db926b053144943361bc64c37f7.bin.dll,#1
2⤵
PID:364

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-2-0x0000000000000000-mapping.dmp

Download
memory/364-3-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/364-4-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download