gozi_ifsb | ee784e9f14aa4c0729d35f8cfb96618d33173cf6ea8db49c5f3fca1938afda9c

Analysis

max time kernel
143s
max time network
151s
platform
windows10_x64
resource
win10-en-20210920
submitted
18/10/2021, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
323418a0b6f38ca1bce0a72ed3081ab4.dll
Size 606KB
Sample211018-p2zftadeh9
SHA256 ee784e9f14aa4c0729d35f8cfb96618d33173cf6ea8db49c5f3fca1938afda9c
MD5 323418a0b6f38ca1bce0a72ed3081ab4
SHA1 47993e38dc59752fa26e08a8af1da896a6121dd9
SHA512 378cf5ee6c6fa7ee854b38c48d599dfcb1f94a3c11e1f114ce21ca0c15834c24e324db37b2272b39d1e039edd011491f66622a18d00f2f0fea17616d8790db10
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 5566 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

5566

outlook.com
peajame.com
gderrrpololo.net

Attributes

build
250211
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Blocklisted process makes network request 8 IoCs

flow	pid	Process
26	1804	rundll32.exe
28	1804	rundll32.exe
30	1804	rundll32.exe
32	1804	rundll32.exe
34	1804	rundll32.exe
35	1804	rundll32.exe
38	1804	rundll32.exe
40	1804	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 1804	3596	rundll32.exe	70
PID 3596 wrote to memory of 1804	3596	rundll32.exe	70
PID 3596 wrote to memory of 1804	3596	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\323418a0b6f38ca1bce0a72ed3081ab4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\323418a0b6f38ca1bce0a72ed3081ab4.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-116-0x0000000073710000-0x000000007384B000-memory.dmp

Download

memory/1804-117-0x0000000073710000-0x000000007371F000-memory.dmp

Download

memory/1804-118-0x0000000073710000-0x000000007384B000-memory.dmp

Download

memory/1804-119-0x0000000000B30000-0x0000000000C7A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads