gozi_ifsb | f824b2391d7ef4d4214ff90664192f4e2cb9636e80688593a800bf1aefbb07a7

Analysis

max time kernel
40s
max time network
53s
platform
windows7_x64
resource
win7v20210408
submitted
03/06/2021, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
racial.drc.dll
Size 515KB
Sample210603-8vpcgaskmn
SHA256 f824b2391d7ef4d4214ff90664192f4e2cb9636e80688593a800bf1aefbb07a7
MD5 1e50905e13be743056a296745da33567
SHA1 7483be7ed1d73f97634c6de6aaa1829f96e712e2
SHA512 97d747eac37df0a1ae21a660205bd9f8d6c4254e03f0b9aa1720a9e8ce9571b65c7c7662689de212ffe2b25086e2177adce3119a46ab59ef23dee313aece83e9
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 1500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1500

authd.feronok.com
raw.pablowilliano.at

Attributes

build
250188
exe_type
loader
server_id
580

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 292 wrote to memory of 1960	292	regsvr32.exe	26
PID 292 wrote to memory of 1960	292	regsvr32.exe	26
PID 292 wrote to memory of 1960	292	regsvr32.exe	26
PID 292 wrote to memory of 1960	292	regsvr32.exe	26
PID 292 wrote to memory of 1960	292	regsvr32.exe	26
PID 292 wrote to memory of 1960	292	regsvr32.exe	26
PID 292 wrote to memory of 1960	292	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\racial.drc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:292
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\racial.drc.dll
  2⤵
  PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-59-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Download

memory/1960-61-0x0000000075211000-0x0000000075213000-memory.dmp

Download

memory/1960-63-0x00000000745B0000-0x0000000074640000-memory.dmp

Download

memory/1960-62-0x00000000745B0000-0x00000000745BD000-memory.dmp

Download

memory/1960-64-0x00000000000C0000-0x00000000000C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads