gozi_ifsb | c45c6faa94764a703ef64098046ffbb24eebd81bc360f31f441b884a8cddae5f

Analysis

max time kernel
15s
max time network
124s
platform
windows10_x64
resource
win10v20210410
submitted
10/08/2021, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
611242387c2b3.dll
Size 481KB
Sample210810-5p7jf2akbj
SHA256 c45c6faa94764a703ef64098046ffbb24eebd81bc360f31f441b884a8cddae5f
MD5 826e27ebe4950a57b944757673b9a93a
SHA1 2fb95c18197d28fa2f06256320db4b277e126671
SHA512 07a6634a640336eee87b9592d5bc3255ab806c46a47c7155c75f0689a2c32184e74ea177741e5af2335f5e08fe8568eac2dcd0c8397d34302085c21f9d832b0a
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 8877 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

outlook.com
boyuleruner.online
coyuleruner.online

Attributes

build
250207
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3952	3916	rundll32.exe	72
PID 3916 wrote to memory of 3952	3916	rundll32.exe	72
PID 3916 wrote to memory of 3952	3916	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\611242387c2b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\611242387c2b3.dll,#1
  2⤵
  PID:3952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-115-0x00000000739B0000-0x00000000739BF000-memory.dmp

Download

memory/3952-116-0x00000000739B0000-0x0000000073A3F000-memory.dmp

Download

memory/3952-117-0x0000000000F90000-0x0000000000F91000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads