gozi_ifsb | 35375028a2cc4876b5a8476876ad75a037b8c4e303589ce6e9d9c61aaba9f74c

Analysis

max time kernel
91s
max time network
93s
platform
windows7_x64
resource
win7v20201028
submitted
02/03/2021, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deli.png.dll
Size 264KB
Sample210302-bj89jvs9va
SHA256 35375028a2cc4876b5a8476876ad75a037b8c4e303589ce6e9d9c61aaba9f74c
MD5 225969564af689a1c330bf8e095281ff
SHA1 bcd1b29c7faf778be8eece7faf1b42e13b6030d9
SHA512 413f110a04403cdb0a14a336d25bffe3d71965a566b2e92b0225fff2a9a6750bd401aa94a0ac493b2206506fc7eab5360d7ddd3c1bee0b5162f7da9e44e047e0
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 7253 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

7253

web.vortex.data.microsoft.com
ocsp.sca1b.amazontrust.com
stasecrets.com

Attributes

build
250186
dns_servers
107.174.86.134

107.175.127.22
exe_type
loader
server_id
12

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1348	1968	regsvr32.exe	26
PID 1968 wrote to memory of 1348	1968	regsvr32.exe	26
PID 1968 wrote to memory of 1348	1968	regsvr32.exe	26
PID 1968 wrote to memory of 1348	1968	regsvr32.exe	26
PID 1968 wrote to memory of 1348	1968	regsvr32.exe	26
PID 1968 wrote to memory of 1348	1968	regsvr32.exe	26
PID 1968 wrote to memory of 1348	1968	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\deli.png.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\deli.png.dll
  2⤵
  PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-4-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Download

memory/1348-5-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/1348-6-0x0000000000BB0000-0x0000000000CF0000-memory.dmp

Download

memory/1968-2-0x000007FEFB831000-0x000007FEFB833000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads