gozi_rm3 | b4f98cb2d21258819d8678c29486a2e7854d576efc28b58d930551ca5aa24f20

Target

ewgr.png.dll
Size

646KB
MD5

cf24c392a94a9bd8f381f0de2926a4f2
SHA1

bf5ba2b5f9062b1a99797b593e378a1e59faa142
SHA256

b4f98cb2d21258819d8678c29486a2e7854d576efc28b58d930551ca5aa24f20
SHA512

ef2707615abb03cdda353d1ed081814fd77b0af78315d410736bb5e989d42f634c75f876c062254c25ec96e5b7fbb78bf41c7651cbd7d2efa68a49de61848ec0

Score

10^/10

Malware Config

Family

gozi_rm3

Botnet

201193209

https://binobin.xyz

Attributes

rsa_pubkey.base64

serpent.plain

Gozi RM3
A heavily modified version of Gozi using RM3 loader.
banker trojan gozi_rm3
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2208 808 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2208	808	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2208 WerFault.exe
Token: SeBackupPrivilege 2208 WerFault.exe
Token: SeDebugPrivilege 2208 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 412 wrote to memory of 808	412	rundll32.exe	rundll32.exe
PID 412 wrote to memory of 808	412	rundll32.exe	rundll32.exe
PID 412 wrote to memory of 808	412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ewgr.png.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ewgr.png.dll,#1
2⤵
PID:808

memory/808-2-0x0000000000000000-mapping.dmp

Download
memory/808-3-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/808-4-0x00000000049D0000-0x00000000049E2000-memory.dmp

Filesize
72KB

Download
memory/808-6-0x0000000000C30000-0x0000000000C3E000-memory.dmp

Filesize
56KB

Download
memory/808-7-0x0000000000C50000-0x0000000000C60000-memory.dmp

Filesize
64KB

Download
memory/2208-5-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download