gozi_ifsb | 2f4d76314a00fb7a8047fcdd3ee26c39d2a550cde356d35ae517631392a66e8a

Analysis

max time kernel
143s
max time network
148s
platform
windows10_x64
resource
win10v20210408
submitted
05/10/2021, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
#Gozi.dll
Size 1.2MB
Sample211005-lrm39ahhcn
SHA256 2f4d76314a00fb7a8047fcdd3ee26c39d2a550cde356d35ae517631392a66e8a
MD5 fe127f07c086ee240c4699ae97b23672
SHA1 980b76c3bb9f12c2033897c9e432c3f0f4d3db31
SHA512 4442d5342ea200a05fbc95f5281fdda7aacfad7c22665c8f10d0c81db0fd6009344a77c708bfca129026037b8985772682e439a2325bc55cf46e9b4e89b51381
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 8899 banker suricata trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8899

msn.com/login
vloderuniok.website
gloderuniok.website

Attributes

build
260212
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
suricata
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata

Blocklisted process makes network request 13 IoCs

flow	pid	Process
11	64	rundll32.exe
13	64	rundll32.exe
15	64	rundll32.exe
17	64	rundll32.exe
18	64	rundll32.exe
20	64	rundll32.exe
24	64	rundll32.exe
25	64	rundll32.exe
27	64	rundll32.exe
28	64	rundll32.exe
29	64	rundll32.exe
30	64	rundll32.exe
31	64	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 64	1096	rundll32.exe	68
PID 1096 wrote to memory of 64	1096	rundll32.exe	68
PID 1096 wrote to memory of 64	1096	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\#Gozi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\#Gozi.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:64

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/64-115-0x0000000073850000-0x000000007385F000-memory.dmp

Download

memory/64-116-0x0000000073850000-0x0000000074287000-memory.dmp

Download

memory/64-117-0x0000000002EE0000-0x000000000302A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads