gozi_ifsb | 5831ebc72dc810c036fa0c1dc85e17490ebfe2f7379b9573f99d47817b9eb42c

Analysis

max time kernel
31s
max time network
114s
platform
windows10_x64
resource
win10v20210410
submitted
29/06/2021, 10:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
60daf82a3cb4e.dll
Size 360KB
Sample210629-svfpkrd97j
SHA256 5831ebc72dc810c036fa0c1dc85e17490ebfe2f7379b9573f99d47817b9eb42c
MD5 c33644c4f82a0c81ebc17e8c47ff2151
SHA1 592380317ff6d62338eeedf0f87b2937316c8e33
SHA512 cd0712be489241dc01b33b6f2f3cd3f34db2eddb6a282bf6a5b6e2226311a227aad3d986b9825cb5fa76266bcc3c8b2fb95f9df2650ac6b6ec55fc32b0efdac1
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

outlook.com
ghjakappoppepeodkd.website
hteadclsspdkmdasd.live

Attributes

build
250206
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2260	4060	rundll32.exe	69
PID 4060 wrote to memory of 2260	4060	rundll32.exe	69
PID 4060 wrote to memory of 2260	4060	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60daf82a3cb4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60daf82a3cb4e.dll,#1
  2⤵
  PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-116-0x0000000073E10000-0x0000000073F04000-memory.dmp

Download

memory/2260-115-0x0000000073E10000-0x0000000073E1F000-memory.dmp

Download

memory/2260-117-0x0000000003240000-0x00000000032EE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads