gozi_ifsb | 2f1a6b566dc0d2b8e5fcdcf67adc0be912f73fe14c27b262b610dfcd03cd4686

Analysis

max time kernel
45s
max time network
14s
platform
windows7_x64
resource
win7v20201028
submitted
15-03-2021 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads1/484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe
Size

376KB
MD5

b74cfd9313cd899c8a5f487fe2db5c1a
SHA1

721a19a510c00f8407c94771619971c427c4358d
SHA256

484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92
SHA512

289effb488f885f7ead36460b3c61b5fd587cad3c891f43d3328b21a1f3ab74213887a3793a6c3195da81cd641ba456dc583697dede12d17d943ff5cf0ed5356

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Loads dropped DLL 1 IoCs

Processes:

484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe

pid process

1908 484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe

pid	process
1908	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe

description	pid	process	target process
PID 1908 set thread context of 1756	1908	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe

pid process

1908 484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe

pid	process
1908	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe

description	pid	process	target process
PID 1908 wrote to memory of 1756	1908	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe
PID 1908 wrote to memory of 1756	1908	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe
PID 1908 wrote to memory of 1756	1908	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe
PID 1908 wrote to memory of 1756	1908	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe
PID 1908 wrote to memory of 1756	1908	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe	484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe

C:\Users\Admin\AppData\Local\Temp\Downloads1\484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads1\484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\Downloads1\484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads1\484b0d880db7b05aa0b459e22c8c6f4dd1dd74f0731c46a24a1447b1f1a7ad92.exe"
2⤵
PID:1756

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nscE15.tmp\docks.dll
MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
memory/1756-5-0x00000000004010E7-mapping.dmp

Download
memory/1756-7-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1908-2-0x0000000076271000-0x0000000076273000-memory.dmp

Filesize
8KB

Download
memory/1908-4-0x00000000024A0000-0x00000000024EB000-memory.dmp

Filesize
300KB

Download