gozi_ifsb | decc5373395af97614b932bb9bd99d8febd84cfd8ca09cc7d765f187c9253907

Resubmissions

23-08-2021 18:19

24-12-2020 08:17

Target

5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6.dll
Size

619KB
MD5

06369d24c347761e4c618f4759c0de01
SHA1

b76ab3c1e5a5fbe177030fd6e4a2c082c2f43264
SHA256

5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6
SHA512

c2efe5c5d999961a345a06d49361e5fb7cfa6f8ca13ec1d919279c99fa8863394157b2f6c9695922fc172d5322157360549f1a048fff648f2cab9d7fe7436547

Score

10^/10

Family

gozi_ifsb

Botnet

1100

api10.laptok.at/api1

Attributes

rsa_pubkey.plain

serpent.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4028	1840	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1840	900	rundll32.exe	71
PID 900 wrote to memory of 1840	900	rundll32.exe	71
PID 900 wrote to memory of 1840	900	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e320cafb35de3e8f8c8c5878fe399143eda3b5a8b2076171754c97f350135a6.dll,#1
  2⤵
  PID:1840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 612
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4028

memory/1840-116-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/1840-115-0x0000000004CF0000-0x0000000004D3B000-memory.dmp

Filesize
300KB

Download