gozi_ifsb | 93ba5e117699976d0df8512ca37262af3dbb68897fc50167bacef1930c64816f | Triage

Analysis

max time kernel
29s
max time network
125s
platform
windows10_x64
resource
win10v20210410
submitted
29-06-2021 05:11

Sharing

Report Analysis Logs

General

Target

malware binary.dll
Size

492KB
MD5

84fd8b680be80ace7562c2a1f2547e96
SHA1

2528e75c0867dd07259b2fc42f0850d259eed418
SHA256

93ba5e117699976d0df8512ca37262af3dbb68897fc50167bacef1930c64816f
SHA512

e30ac5739174b6c1dba146e600fc2454b4fc89362ae953d14f26c9b77d90f117d89adb44c6af0f82c9b8f68874f5885316ee9993b1fdd08585210ce47f3353c4

Score

10^/10

gozi_ifsb 6000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

6000

C2

authd.feronok.com

app.bighomegl.at

Attributes

build
250204
exe_type
loader
server_id
580

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3540 wrote to memory of 3932	3540	rundll32.exe	rundll32.exe
PID 3540 wrote to memory of 3932	3540	rundll32.exe	rundll32.exe
PID 3540 wrote to memory of 3932	3540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\malware binary.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\malware binary.dll",#1
2⤵
PID:3932

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3932-114-0x0000000000000000-mapping.dmp

Download
memory/3932-115-0x00000000045D0000-0x0000000004660000-memory.dmp

Filesize
576KB

Download
memory/3932-117-0x00000000045D1000-0x0000000004624000-memory.dmp

Filesize
332KB

Download
memory/3932-116-0x00000000045D0000-0x00000000045DD000-memory.dmp

Filesize
52KB

Download
memory/3932-118-0x0000000000B00000-0x0000000000C4A000-memory.dmp

Filesize
1.3MB

Download