gozi_ifsb | 6e4568c87d8d2b5d6428ce46362b1ae29559047aafc275948cd4510573e460a8

Analysis

Target
6e4568c87d8d2b5d6428ce46362b1ae29559047aafc275948cd4510573e460a8.dll
Size 264KB
Sample210331-k4b3r8kyan
SHA256 6e4568c87d8d2b5d6428ce46362b1ae29559047aafc275948cd4510573e460a8
MD5 405f0a8c869db4b3f2db4a838c8d6f17
SHA1 47b9cb06603d9704c2206d271dfc63edd7cfc539
SHA512 e3de3d237afa2528b82967d056a88066127f9ca3f8e1a5f1d9fb3f19282ff820a6e958f7252567832cf715a1324577fa54bb7a8530f1872305486b586edcf6b4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.base64

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4892	4760	regsvr32.exe	70
PID 4760 wrote to memory of 4892	4760	regsvr32.exe	70
PID 4760 wrote to memory of 4892	4760	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6e4568c87d8d2b5d6428ce46362b1ae29559047aafc275948cd4510573e460a8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6e4568c87d8d2b5d6428ce46362b1ae29559047aafc275948cd4510573e460a8.dll
  2⤵
  PID:4892

memory/4892-3-0x0000000073070000-0x000000007307F000-memory.dmp

Download

memory/4892-4-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Download