gozi_ifsb | 913535ed97ea88e3b80fe9032698ff77d697243cd8badf34aa9870e18c689121 | Triage

Analysis

max time kernel
22s
max time network
76s
platform
windows10_x64
resource
win10v20210408
submitted
22-06-2021 09:03

Sharing

Report Analysis Logs

General

Target

60d1a6a1be17f.dll
Size

349KB
MD5

af580b336ff6905cd6b28f2cbb74efad
SHA1

671119f873ad83df335b97af20c1381efa97f7dc
SHA256

913535ed97ea88e3b80fe9032698ff77d697243cd8badf34aa9870e18c689121
SHA512

ab949f7c5fce9ac8ab8ea4563bf581204b691a8d62f1727c5bec507093bfc6d80e4c6d8be9ef0aa6d7773c08e219fb11b9f63415c82010b12a2e379eb162aa08

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

C2

outlook.com

gerimerunollu.club

herimerunollu.club

Attributes

build
250206
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 508	656	rundll32.exe	69
PID 656 wrote to memory of 508	656	rundll32.exe	69
PID 656 wrote to memory of 508	656	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60d1a6a1be17f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60d1a6a1be17f.dll,#1
  2⤵
  PID:508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/508-116-0x00000000739A0000-0x0000000073A98000-memory.dmp

Filesize
992KB

Download
memory/508-115-0x00000000739A0000-0x00000000739AF000-memory.dmp

Filesize
60KB

Download
memory/508-117-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download