gozi_ifsb | 4eac07d82b1f1bcc956d6406bcdb2978493f4565ffd503814f6e63a63554ec5e

Analysis

Target
2021-03-17-installer-DLL-for-Urnsif-example-7-of-12.bin.dll
Size 626KB
Sample210318-1yc2pcnca2
SHA256 4eac07d82b1f1bcc956d6406bcdb2978493f4565ffd503814f6e63a63554ec5e
MD5 11fabcb45618b325da47dadd6dbe4ca7
SHA1 dc8e58f33516e5c336bfd5b1738ca12f1d8eb8a7
SHA512 b932c6ffb96271818ec6bda8c1b85dc4787ae8664021f7562f60b83ebb6cb9278d3fdd809b77e8ae5346253eaf62a7129e597a0099e8a756816252ada04c8a5f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.base64

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1620	1308	rundll32.exe	69
PID 1308 wrote to memory of 1620	1308	rundll32.exe	69
PID 1308 wrote to memory of 1620	1308	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2021-03-17-installer-DLL-for-Urnsif-example-7-of-12.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2021-03-17-installer-DLL-for-Urnsif-example-7-of-12.bin.dll,#1
  2⤵
  PID:1620

memory/1620-3-0x0000000073FF0000-0x0000000073FFF000-memory.dmp

Download

memory/1620-4-0x00000000032A0000-0x00000000032A1000-memory.dmp

Download