gozi_ifsb | 410eb4b06644f073370230650fe0624ce5dc6e18481b2e85930865a5a3984160

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-en-20211208
submitted
16/02/2022, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
readme.dll
Size 396KB
Sample220216-jsp8wsbdf4
SHA256 410eb4b06644f073370230650fe0624ce5dc6e18481b2e85930865a5a3984160
MD5 4a6e16d9cdefd1b6a6d4540fcfbf64b2
SHA1 514c1aa17bb07dff3d56dfe9a2f4942d45dc1b85
SHA512 1e0a78f7cea20bf8d226a1f4864488c01bb1eeab2f0ecb23c1c2c3a87b5af06b71a29f2f41048536f09890c925d86eb94b2ac17aa32ac639461274d419121fdf
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 7614 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

7614

servicelines.top
servicelines.space
linkspremium.ru
premiumlists.ru

Attributes

base_path
/drew/
build
250225
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1744	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1744	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1744	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1744	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1744	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1744	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1744	1512	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\readme.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\readme.dll
  2⤵
  PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-55-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Download

memory/1744-56-0x0000000075191000-0x0000000075193000-memory.dmp

Download

memory/1744-58-0x0000000000140000-0x0000000000142000-memory.dmp

Download

memory/1744-57-0x0000000010035000-0x0000000010037000-memory.dmp

Download

memory/1744-59-0x0000000010000000-0x0000000010071000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads