gozi_ifsb | a67282c6f37a82765eeadefaf4245a2dacba3f6def9c5bf8460e01e38cfff70c

Analysis

max time kernel
118s
max time network
117s
platform
windows7_x64
resource
win7v20201028
submitted
29/03/2021, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2803.gif.exe.dll
Size 359KB
Sample210329-kb9kld239e
SHA256 a67282c6f37a82765eeadefaf4245a2dacba3f6def9c5bf8460e01e38cfff70c
MD5 ee3942b590be4220fcec1cfff0f3487f
SHA1 9c813cf77dcb9d9ae4cb3304309f33a8762399d6
SHA512 8ebe18ba8a76eab6063e87f9809546cb6f84fe681fa2f9becc85c5111fea15bfd2d188f126f8a24f2a78a8ecd3723a1123c62cc4c8e455ec7a761f3c0d0410ff
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 5566 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

5566

bing.com
update4.microsoft.com
fdjjasdoeoriefjd.live
paralikulat.website

Attributes

build
250187
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1692	2044	regsvr32.exe	26
PID 2044 wrote to memory of 1692	2044	regsvr32.exe	26
PID 2044 wrote to memory of 1692	2044	regsvr32.exe	26
PID 2044 wrote to memory of 1692	2044	regsvr32.exe	26
PID 2044 wrote to memory of 1692	2044	regsvr32.exe	26
PID 2044 wrote to memory of 1692	2044	regsvr32.exe	26
PID 2044 wrote to memory of 1692	2044	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2803.gif.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2803.gif.exe.dll
  2⤵
  PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-4-0x0000000075251000-0x0000000075253000-memory.dmp

Download

memory/1692-5-0x0000000002200000-0x000000000471D000-memory.dmp

Download

memory/1692-6-0x0000000010000000-0x000000001251D000-memory.dmp

Download

memory/2044-2-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads