gozi_ifsb | 67eaada8a12b536d407706e21e7f5b38ccc29d62e40dd66bbf2b2902df0169f0 | Triage™

Analysis

max time kernel
142s
max time network
145s
platform
windows10_x64
resource
win10-en-20211014
submitted
30/11/2021, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6.bin.dll
Size 138KB
Sample211130-q89e2afbbj
SHA256 67eaada8a12b536d407706e21e7f5b38ccc29d62e40dd66bbf2b2902df0169f0
MD5 e7b4153cc22f46f87835b6d59d6905e4
SHA1 ca6f9879c802bf96697354b01c61e5a98b769275
SHA512 e8e6de8e3ccdd5de96747938fea18294c428794a11e77b96a494be1e54c2641f26a995733e6e307eece9c7635c7b70a329527d01a86134ac1095b696c8a19012
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 8899 banker suricata trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8899

C2

microsoft.com/windowsdisabler
bvolebukoneh.site
karfaganda.com

Attributes

build
260216
dga_season
10
exe_type
loader
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
suricata
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4344	4312	regsvr32.exe	68
PID 4312 wrote to memory of 4344	4312	regsvr32.exe	68
PID 4312 wrote to memory of 4344	4312	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6.bin.dll
  2⤵
  PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4344-116-0x00000000001E0000-0x00000000001EF000-memory.dmp

Download