gozi_ifsb | 419e1f52d1dd72ef9e9d2af16124abcaa2cc889389bbb10bb8d1fa23276ba697

Analysis

max time kernel
68s
max time network
110s
platform
windows10_x64
resource
win10v20210408
submitted
28/04/2021, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2223108b78386fb1e01d0ebd47429254.dll
Size 937KB
Sample210428-llsq1srd8a
SHA256 419e1f52d1dd72ef9e9d2af16124abcaa2cc889389bbb10bb8d1fa23276ba697
MD5 2223108b78386fb1e01d0ebd47429254
SHA1 42ba1dea99956340c037439e2af4689bec82b721
SHA512 62bb22d2db73af9c83fbc3fbdcd41d954384f5d1aff7ac69decabe9d05a5a03129c32555304155b14452c0a5f41129d48e8347c5ae9c1c73475ae69863c7bb44
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 4500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

4500

app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click

Attributes

build
250188
exe_type
loader
server_id
580

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 1148	796	rundll32.exe	69
PID 796 wrote to memory of 1148	796	rundll32.exe	69
PID 796 wrote to memory of 1148	796	rundll32.exe	69
PID 1148 wrote to memory of 4004	1148	rundll32.exe	76
PID 1148 wrote to memory of 4004	1148	rundll32.exe	76
PID 1148 wrote to memory of 4004	1148	rundll32.exe	76
PID 1148 wrote to memory of 3788	1148	rundll32.exe	78
PID 1148 wrote to memory of 3788	1148	rundll32.exe	78
PID 1148 wrote to memory of 3788	1148	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2223108b78386fb1e01d0ebd47429254.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2223108b78386fb1e01d0ebd47429254.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cd Island
    3⤵
    PID:4004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cd Matter m
    3⤵
    PID:3788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-118-0x00000000735F0000-0x00000000736F4000-memory.dmp

Download

memory/1148-117-0x00000000735F0000-0x00000000735FE000-memory.dmp

Download

memory/1148-119-0x0000000000530000-0x000000000067A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads