gozi_ifsb | 4edfb1b3a28524cdf10d2e10ba4e6411013607949359987c07d3d715bfca3cce

Analysis

Target

4edfb1b3a28524cdf10d2e10ba4e6411013607949359987c07d3d715bfca3cce.dll
Size

497KB
MD5

11e1bb1bb27820c92a7c4a4c1a356184
SHA1

99755d73681d052d3391c9f2b90030272faa640f
SHA256

4edfb1b3a28524cdf10d2e10ba4e6411013607949359987c07d3d715bfca3cce
SHA512

52effae2a754dcd59501620f3567bf3f4ed4e2faad02d15dbf53483710e2504be572b35f5cce74a1923df6f77641acfd612cc99e829d27787b5827c4b14063c8

Score

10^/10

Family

gozi_ifsb

Botnet

1500

apt.updateffboruse.com

app.updatebrouser.com

Attributes

rsa_pubkey.plain

aes.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1240 wrote to memory of 1524	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1524	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1524	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1524	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1524	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1524	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1524	1240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4edfb1b3a28524cdf10d2e10ba4e6411013607949359987c07d3d715bfca3cce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4edfb1b3a28524cdf10d2e10ba4e6411013607949359987c07d3d715bfca3cce.dll,#1
2⤵
PID:1524

memory/1524-55-0x0000000000000000-mapping.dmp

Download
memory/1524-56-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1524-57-0x00000000750F0000-0x0000000075208000-memory.dmp

Filesize
1.1MB

Download
memory/1524-59-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1524-60-0x00000000750F0000-0x0000000075208000-memory.dmp

Filesize
1.1MB

Download
memory/1524-58-0x00000000750F0000-0x00000000750FD000-memory.dmp

Filesize
52KB

Download