gozi_ifsb | 54ce5aedb7cc073c481eb8af96f89f3ab11e5decaccf942d033479fd0f04c8b3

Analysis

max time kernel
120s
max time network
164s
platform
windows7_x64
resource
win7v20210408
submitted
13/07/2021, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
60ed4ca406c9c.dll
Size 464KB
Sample210713-levy8ccgre
SHA256 54ce5aedb7cc073c481eb8af96f89f3ab11e5decaccf942d033479fd0f04c8b3
MD5 0b0f6ef1bb8553c3c47e9330781c0d03
SHA1 c782b922dcc92b24dfd80f98d96b61df64f79f18
SHA512 32a37baa9f5513f457adb28abfbdebc8d74e171dc0374f155e14ddaac2657fba5645345e5bb4ee188bf70d8a5d5d55a3bb50d61658d933a95e6b944ab41322f6
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

outlook.com
dronmakerparallel.email
moonlightparallels.email

Attributes

build
250207
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 560	816	rundll32.exe	27
PID 816 wrote to memory of 560	816	rundll32.exe	27
PID 816 wrote to memory of 560	816	rundll32.exe	27
PID 816 wrote to memory of 560	816	rundll32.exe	27
PID 816 wrote to memory of 560	816	rundll32.exe	27
PID 816 wrote to memory of 560	816	rundll32.exe	27
PID 816 wrote to memory of 560	816	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60ed4ca406c9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60ed4ca406c9c.dll,#1
  2⤵
  PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-60-0x0000000075511000-0x0000000075513000-memory.dmp

Download

memory/560-61-0x0000000000610000-0x0000000000723000-memory.dmp

Download

memory/560-62-0x0000000000610000-0x000000000061F000-memory.dmp

Download

memory/560-63-0x00000000000B0000-0x00000000000B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads