gozi_ifsb | 20587442b6c5c5289058461103db705d04b69ee7e5c14d6a3089348c19bc0de7 | Triage

Analysis

max time kernel
122s
max time network
155s
platform
windows7_x64
resource
win7v20210408
submitted
11-06-2021 19:00

Sharing

Report Analysis Logs

General

Target

9d3a7a1f655bdc0714e010f31ad4c6cc.ttf.dll
Size

374KB
MD5

9d3a7a1f655bdc0714e010f31ad4c6cc
SHA1

5115f00d59147a3113fab9402daeb34ffe71ae39
SHA256

20587442b6c5c5289058461103db705d04b69ee7e5c14d6a3089348c19bc0de7
SHA512

65a17e759ff8b47c01e24a0eec98c6d4bcea0001613c6214a3b1f015437f2998810aef349190fcaaf75cc692e8877c1fa3901b5d69838468c1cb416ee64c4b21

Score

10^/10

gozi_ifsb 4500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

4500

C2

authd.feronok.com

app.bighomegl.at

Attributes

build
250204
exe_type
loader
server_id
580

rsa_pubkey.base64

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1924 wrote to memory of 1236	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1236	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1236	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1236	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1236	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1236	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1236	1924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d3a7a1f655bdc0714e010f31ad4c6cc.ttf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d3a7a1f655bdc0714e010f31ad4c6cc.ttf.dll,#1
2⤵
PID:1236

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-60-0x0000000000000000-mapping.dmp

Download
memory/1236-61-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/1236-63-0x0000000074CC0000-0x0000000074D65000-memory.dmp

Filesize
660KB

Download
memory/1236-62-0x0000000074CC0000-0x0000000074CCD000-memory.dmp

Filesize
52KB

Download
memory/1236-64-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download