gozi_ifsb | e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows10_x64
resource
win10v20210410
submitted
11-05-2021 10:57

Sharing

Report Analysis Logs

General

Target

1752fe2b8419be8241ecd08859a5800f.dll
Size

821KB
MD5

1752fe2b8419be8241ecd08859a5800f
SHA1

eb7346a6d5a53ddaf8fd073f266c64d642b40a7d
SHA256

e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0
SHA512

0718e566bdec828d59890818a65af53f467d1bab92abbdd2ecfe3eca55be7ad3692793e4310ea41f2ab2a9f5e9fe6d29e1873cacc1614c6f2cceaf6b320c8f15

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

C2

outlook.com/login

gmail.com

worunekulo.club

horunekulo.website

Attributes

build
250196
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3944 wrote to memory of 4068	3944	rundll32.exe	rundll32.exe
PID 3944 wrote to memory of 4068	3944	rundll32.exe	rundll32.exe
PID 3944 wrote to memory of 4068	3944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1752fe2b8419be8241ecd08859a5800f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1752fe2b8419be8241ecd08859a5800f.dll,#1
  2⤵
  PID:4068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4068-114-0x0000000000000000-mapping.dmp

Download
memory/4068-116-0x00000000735F0000-0x00000000736DF000-memory.dmp

Filesize
956KB

Download
memory/4068-115-0x00000000735F0000-0x00000000735FF000-memory.dmp

Filesize
60KB

Download
memory/4068-117-0x0000000004040000-0x0000000004041000-memory.dmp

Filesize
4KB

Download