gozi_ifsb | 92df4c929fde89abd9aca880f6e942e432853e5e8db64ffe4c19929ff4e2342f | Triage

Analysis

max time kernel
12s
max time network
111s
platform
windows10_x64
resource
win10v20210410
submitted
05-05-2021 13:20

Sharing

Report Analysis Logs

General

Target

bac6b7118aa1f9c9fe229393a7fcdb26.dll
Size

133KB
MD5

bac6b7118aa1f9c9fe229393a7fcdb26
SHA1

e3bb8b1bad2f17bf48d7b3b5675e404f64b9e7cf
SHA256

92df4c929fde89abd9aca880f6e942e432853e5e8db64ffe4c19929ff4e2342f
SHA512

582cb7fe2f299dc67cbcac14621e6ee40a047367a9b53a10d7765b68b1af863df58ca2324424d1f6baa3b4007a42fed67459fa5fdca0abb56d98dfbef6ecf1b5

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
250187
exe_type
loader

rsa_pubkey.base64

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2112 wrote to memory of 4072	2112	rundll32.exe	rundll32.exe
PID 2112 wrote to memory of 4072	2112	rundll32.exe	rundll32.exe
PID 2112 wrote to memory of 4072	2112	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bac6b7118aa1f9c9fe229393a7fcdb26.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bac6b7118aa1f9c9fe229393a7fcdb26.dll,#1
2⤵
PID:4072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-114-0x0000000000000000-mapping.dmp

Download
memory/4072-115-0x0000000000A10000-0x0000000000A30000-memory.dmp

Filesize
128KB

Download
memory/4072-116-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download