gozi_ifsb | 1a0d4b328438a72cee012f6387825d942463b896fadc13f2c17e8d005f510cd4 | Triage

Analysis

max time kernel
126s
max time network
129s
platform
windows7_x64
resource
win7v20210408
submitted
12-05-2021 11:04

Sharing

Report Analysis Logs

General

Target

b9b732dbc6f94c79b5767eb98ebd899a.dll
Size

467KB
MD5

b9b732dbc6f94c79b5767eb98ebd899a
SHA1

984a3ba5d4fe06265ce23cec82bda6a63b2bb3bc
SHA256

1a0d4b328438a72cee012f6387825d942463b896fadc13f2c17e8d005f510cd4
SHA512

595b4429e9f13212740ac4f9e12282dc3fdf9e141041695e4fe6302acf7aac2527275cb6a98eec78049758972c946cc62971604f68f7de68ad2350d13bac497a

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

C2

outlook.com/login

gmail.com

worunekulo.club

horunekulo.website

Attributes

build
250196
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1920 wrote to memory of 1156	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1156	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1156	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1156	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1156	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1156	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1156	1920	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9b732dbc6f94c79b5767eb98ebd899a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9b732dbc6f94c79b5767eb98ebd899a.dll,#1
2⤵
PID:1156

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-60-0x0000000000000000-mapping.dmp

Download
memory/1156-61-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/1156-63-0x0000000074CE0000-0x0000000074D71000-memory.dmp

Filesize
580KB

Download
memory/1156-62-0x0000000074CE0000-0x0000000074CEF000-memory.dmp

Filesize
60KB

Download
memory/1156-64-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download