gozi_ifsb | 1be687a0453f23ea53b94a4447c926a9b4b6e01c2788e641b76eb4a5215bd960 | Triage

Analysis

max time kernel
134s
max time network
137s
platform
windows10_x64
resource
win10v20210408
submitted
11-10-2021 14:22

Sharing

Report Analysis Logs

General

Target

5aa733e108f0fa41df88cea0a309affe.dll
Size

701KB
MD5

5aa733e108f0fa41df88cea0a309affe
SHA1

ce79918ca7845f2163360ea40a251912998ea226
SHA256

1be687a0453f23ea53b94a4447c926a9b4b6e01c2788e641b76eb4a5215bd960
SHA512

e18ef98a6bb007ee0ef473cd05bad85ac2f177d316981658e17a12f182effbcc98754fbefc362a4212a8eebcc71fc2e2a15c865b08c50f5990223bcb55d001af

Score

10^/10

gozi_ifsb 8899 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8899

C2

msn.com/mail

breuranel.website

outlook.com/signup

areuranel.website

Attributes

build
260212
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

33 368 rundll32.exe
35 368 rundll32.exe
38 368 rundll32.exe
40 368 rundll32.exe
42 368 rundll32.exe
44 368 rundll32.exe
46 368 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 776 wrote to memory of 368	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 368	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 368	776	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa733e108f0fa41df88cea0a309affe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa733e108f0fa41df88cea0a309affe.dll,#1
2⤵
- Blocklisted process makes network request
PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-114-0x0000000000000000-mapping.dmp

Download
memory/368-115-0x00000000742E0000-0x000000007442C000-memory.dmp

Filesize
1.3MB

Download
memory/368-117-0x00000000742E0000-0x000000007442C000-memory.dmp

Filesize
1.3MB

Download
memory/368-116-0x00000000742E0000-0x00000000742EF000-memory.dmp

Filesize
60KB

Download
memory/368-119-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download