gozi_ifsb | 93ba5e117699976d0df8512ca37262af3dbb68897fc50167bacef1930c64816f

Analysis

max time kernel
4294211s
max time network
134s
platform
windows7_x64
resource
win7-20220311-en
submitted
23-03-2022 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00000001.dll
Size

492KB
MD5

84fd8b680be80ace7562c2a1f2547e96
SHA1

2528e75c0867dd07259b2fc42f0850d259eed418
SHA256

93ba5e117699976d0df8512ca37262af3dbb68897fc50167bacef1930c64816f
SHA512

e30ac5739174b6c1dba146e600fc2454b4fc89362ae953d14f26c9b77d90f117d89adb44c6af0f82c9b8f68874f5885316ee9993b1fdd08585210ce47f3353c4

Score

10^/10

gozi_ifsb 6000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

6000

authd.feronok.com

app.bighomegl.at

Attributes

build
250204
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1372	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1372	AUDIODG.EXE
Token: 33	1372	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1372	AUDIODG.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1800 wrote to memory of 1808	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1808	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1808	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1808	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1808	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1808	1800	rundll32.exe	rundll32.exe
PID 1800 wrote to memory of 1808	1800	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00000001.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00000001.dll,#1
2⤵
PID:1808

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1160

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-61-0x000007FEFB551000-0x000007FEFB553000-memory.dmp

Filesize
8KB

Download
memory/1808-54-0x0000000000000000-mapping.dmp

Download
memory/1808-55-0x0000000075081000-0x0000000075083000-memory.dmp

Filesize
8KB

Download
memory/1808-56-0x0000000000240000-0x00000000002D0000-memory.dmp

Filesize
576KB

Download
memory/1808-59-0x0000000000240000-0x00000000002D0000-memory.dmp

Filesize
576KB

Download
memory/1808-58-0x0000000000240000-0x000000000024D000-memory.dmp

Filesize
52KB

Download
memory/1808-60-0x0000000000240000-0x00000000002D0000-memory.dmp

Filesize
576KB

Download