Overview

overview

10

Static

static

8

5feeee23ec...le.exe

windows10_x64

10

Analysis

  • max time kernel
    333s
  • max time network
    836s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    22-10-2021 09:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5feeee23ecd310ed552b56c1992d5e7f6dbf4e656224a9f3073b83770768e994.bin.sample.exe

  • Size

    505KB

  • MD5

    4d5abd974d213339274581a49e9c2780

  • SHA1

    84d211bdd139ac61f760a3d396c7e19680163313

  • SHA256

    5feeee23ecd310ed552b56c1992d5e7f6dbf4e656224a9f3073b83770768e994

  • SHA512

    0d3daa629fc8161028358b4a496eac4427f2cc9f30999b1a02e89d7a7104ded24e33687c31f7cc2d6b1c5e89e14689b7a265d3b1b4e581a91f03047a52045dcd

Score
10/10
gozi_ifsbbankertrojan

Malware Config

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5feeee23ecd310ed552b56c1992d5e7f6dbf4e656224a9f3073b83770768e994.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\5feeee23ecd310ed552b56c1992d5e7f6dbf4e656224a9f3073b83770768e994.bin.sample.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Users\Admin\AppData\Local\Temp\5feeee23ecd310ed552b56c1992d5e7f6dbf4e656224a9f3073b83770768e994.bin.sample.exe
      "C:\Users\Admin\AppData\Local\Temp\5feeee23ecd310ed552b56c1992d5e7f6dbf4e656224a9f3073b83770768e994.bin.sample.exe"
      2⤵
        PID:4588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 544
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4476

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4588-115-0x0000000000400000-0x0000000000463000-memory.dmp
      Filesize

      396KB

      Download
    • memory/4588-116-0x00000000004010E7-mapping.dmp
      Download
    • memory/4588-117-0x0000000000400000-0x0000000000463000-memory.dmp
      Filesize

      396KB

      Download