gozi_ifsb | f68b7fa37be0ae601a95fb0369757160464b595af8b1f49b4f46eb3bb7a37e45

Analysis

max time kernel
135s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
05/10/2021, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
615c1688eba62_pdf.dll
Size 1.2MB
Sample211005-k56xvahef3
SHA256 f68b7fa37be0ae601a95fb0369757160464b595af8b1f49b4f46eb3bb7a37e45
MD5 48faf019fec69d9d4c5c1fd087bf42bb
SHA1 fad47bf3d28874b86ef9fc3ca3f73e19b445e6a1
SHA512 3de577b39ea770969db66244b130812537e00e693361f3e54d9556fefb07b1922d4f31874a86adc431951922b298aca3465d26a4a16be501f6ed573417812345
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 8899 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8899

msn.com/login
vloderuniok.website
gloderuniok.website

Attributes

build
260212
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Blocklisted process makes network request 13 IoCs

flow	pid	Process
12	4664	rundll32.exe
14	4664	rundll32.exe
16	4664	rundll32.exe
18	4664	rundll32.exe
19	4664	rundll32.exe
21	4664	rundll32.exe
25	4664	rundll32.exe
26	4664	rundll32.exe
27	4664	rundll32.exe
28	4664	rundll32.exe
29	4664	rundll32.exe
30	4664	rundll32.exe
31	4664	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4664	4648	rundll32.exe	68
PID 4648 wrote to memory of 4664	4648	rundll32.exe	68
PID 4648 wrote to memory of 4664	4648	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\615c1688eba62_pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\615c1688eba62_pdf.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4664-115-0x0000000073220000-0x000000007322F000-memory.dmp

Download

memory/4664-116-0x0000000073220000-0x0000000073C57000-memory.dmp

Download

memory/4664-117-0x0000000000C60000-0x0000000000C61000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads