gozi_ifsb | 310ac7c48b536f71a16706f67fd4d2bed5d9f5708dd460cf3cbc0cd34f43a3ed

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7v20201028
submitted
30/03/2021, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e98e8fbf2fec9c9d36896a08a26a97f.dll
Size 372KB
Sample210330-wcqfltlde2
SHA256 310ac7c48b536f71a16706f67fd4d2bed5d9f5708dd460cf3cbc0cd34f43a3ed
MD5 7e98e8fbf2fec9c9d36896a08a26a97f
SHA1 d3c22e099df48f78765bba4b64e3f006a9e0bcdd
SHA512 6d56845449783147539c38f6418bd2387c92c4bb0fba9040c8130db8c6097cf77557a924337541798dd3b3c1ff5aab00864479867cddcd2512e83bdac963decd
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

ocsp.digicert.com
aus5.mozilla.org
palominoloopus.website
dresdengrauwes.website

Attributes

build
250187
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1372	2008	regsvr32.exe	26
PID 2008 wrote to memory of 1372	2008	regsvr32.exe	26
PID 2008 wrote to memory of 1372	2008	regsvr32.exe	26
PID 2008 wrote to memory of 1372	2008	regsvr32.exe	26
PID 2008 wrote to memory of 1372	2008	regsvr32.exe	26
PID 2008 wrote to memory of 1372	2008	regsvr32.exe	26
PID 2008 wrote to memory of 1372	2008	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7e98e8fbf2fec9c9d36896a08a26a97f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7e98e8fbf2fec9c9d36896a08a26a97f.dll
  2⤵
  PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-4-0x0000000076641000-0x0000000076643000-memory.dmp

Download

memory/1372-5-0x0000000074870000-0x000000007487F000-memory.dmp

Download

memory/1372-6-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/2008-2-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads