gozi_ifsb | 1abd2ae7b4600681751fcd1d401a6ad35fbdd3e231790be49ef7b61333358802

Analysis

max time kernel
31s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
31/03/2021, 05:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6064024521dc9.png.dll
Size 264KB
Sample210331-apjgy6jdcs
SHA256 1abd2ae7b4600681751fcd1d401a6ad35fbdd3e231790be49ef7b61333358802
MD5 114344b10fcf51c14d79e5441e8fa86a
SHA1 1d52817634967190aa11a5c1eee9917839f4f384
SHA512 3cf4279d16e0022a500c578bee2b5976f947d5ff213090c2fa1d3a702168a0cd5c0e7fa789224d921638faec7f25c01f967c8fb4f0deeaffb6ae78f029a99d87
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

ocsp.digicert.com
aus5.mozilla.org
palominoloopus.website
dresdengrauwes.website

Attributes

build
250187
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1288	1812	regsvr32.exe	26
PID 1812 wrote to memory of 1288	1812	regsvr32.exe	26
PID 1812 wrote to memory of 1288	1812	regsvr32.exe	26
PID 1812 wrote to memory of 1288	1812	regsvr32.exe	26
PID 1812 wrote to memory of 1288	1812	regsvr32.exe	26
PID 1812 wrote to memory of 1288	1812	regsvr32.exe	26
PID 1812 wrote to memory of 1288	1812	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6064024521dc9.png.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6064024521dc9.png.dll
  2⤵
  PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-4-0x0000000076241000-0x0000000076243000-memory.dmp

Download

memory/1288-5-0x0000000073FA0000-0x0000000073FAF000-memory.dmp

Download

memory/1288-6-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/1812-2-0x000007FEFBA41000-0x000007FEFBA43000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads