Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 18:45
General
-
Target
d4b2377c5f9af91cc693fce967f3049ab4c6ec75c162276b584002946203a770.exe
-
Size
162KB
-
MD5
fc00657a0e9c136b3381604e2510c9a4
-
SHA1
ac944c1863937b91c04f8d814a91ff31de442af5
-
SHA256
d4b2377c5f9af91cc693fce967f3049ab4c6ec75c162276b584002946203a770
-
SHA512
96811bb08f82f0a9a11c23d77097a59d3e724d6f26c31b1ebbc74277e6f2506b065a97cb6fa12af5b0c485e6c2f2c9d72f8b8de008efc75a33310d6636d94584
Score
10/10
Malware Config
Signatures
-
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4b2377c5f9af91cc693fce967f3049ab4c6ec75c162276b584002946203a770.exe"C:\Users\Admin\AppData\Local\Temp\d4b2377c5f9af91cc693fce967f3049ab4c6ec75c162276b584002946203a770.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1360-55-0x0000000074F61000-0x0000000074F63000-memory.dmpFilesize
8KB
-
memory/1360-57-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1360-58-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/1360-56-0x0000000002290000-0x00000000022B9000-memory.dmpFilesize
164KB