gozi_ifsb | 2eeee8a83dcf0cbfff2dccaf4408c7ac17130d2ee06d31698d2b58e97e280f75 | Triage

Analysis

max time kernel
144s
max time network
136s
submitted
01-01-1970 00:00

Sharing

Report Analysis Logs

General

Target

c3a4ce9f2dd1721a3a25db6cbc0b5dd6.dll
Size

467KB
MD5

c3a4ce9f2dd1721a3a25db6cbc0b5dd6
SHA1

413a02511ce445448f2b338be073330c018c72f7
SHA256

2eeee8a83dcf0cbfff2dccaf4408c7ac17130d2ee06d31698d2b58e97e280f75
SHA512

b28c5203779fe4a5538646b825e23b7fbefcdad832f9c3101e7109b3e491257426e4a45ccbdcf788baa8ffbb7fef3e254dd6a13806e8c3720002d1f207cdf12e

Score

10^/10

gozi_ifsb 8899 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8899

C2

msn.com/mail

realitystorys.com

outlook.com/signup

gderrrpololo.net

Attributes

build
260212
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 968 wrote to memory of 1008	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1008	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1008	968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3a4ce9f2dd1721a3a25db6cbc0b5dd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3a4ce9f2dd1721a3a25db6cbc0b5dd6.dll,#1
2⤵
PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-115-0x0000000000000000-mapping.dmp

Download
memory/1008-116-0x0000000074390000-0x0000000074415000-memory.dmp

Filesize
532KB

Download
memory/1008-118-0x0000000074390000-0x0000000074415000-memory.dmp

Filesize
532KB

Download
memory/1008-117-0x0000000074390000-0x000000007439F000-memory.dmp

Filesize
60KB

Download
memory/1008-119-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download