gozi_ifsb | cf2e63e3364f3ae892bd60b53ce4b8b2ff5b6e60aff138e8e0f7e18aac63c5c4

Analysis

max time kernel
132s
max time network
145s
platform
windows7_x64
resource
win7-20220331-en
submitted
12/04/2022, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf2e63e3364f3ae892bd60b53ce4b8b2ff5b6e60aff138e8e0f7e18aac63c5c4.dll
Size 500KB
Sample220412-mkyf3sdff3
SHA256 cf2e63e3364f3ae892bd60b53ce4b8b2ff5b6e60aff138e8e0f7e18aac63c5c4
MD5 b49b83a98efff5f00dba36d77847bed9
SHA1 b9b38f4de57d69bf417c9bb06041161ab585f941
SHA512 0eb9f2966562a22920506e2c8bfea4dbd6c3fed13072e01c69b3722917504b4ec3e1af7cda4099068fbf0bc80e4eedf881f295169cb20d1aebf0d4637b60e0eb
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com
185.154.53.214
185.154.53.188
46.30.42.246

Attributes

base_path
/drew/
build
260226
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	1976	rundll32.exe
3	1976	rundll32.exe
7	1976	rundll32.exe
8	1976	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1976	1988	rundll32.exe	28
PID 1988 wrote to memory of 1976	1988	rundll32.exe	28
PID 1988 wrote to memory of 1976	1988	rundll32.exe	28
PID 1988 wrote to memory of 1976	1988	rundll32.exe	28
PID 1988 wrote to memory of 1976	1988	rundll32.exe	28
PID 1988 wrote to memory of 1976	1988	rundll32.exe	28
PID 1988 wrote to memory of 1976	1988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf2e63e3364f3ae892bd60b53ce4b8b2ff5b6e60aff138e8e0f7e18aac63c5c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf2e63e3364f3ae892bd60b53ce4b8b2ff5b6e60aff138e8e0f7e18aac63c5c4.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Download

memory/1976-56-0x00000000001D0000-0x000000000024F000-memory.dmp

Download

memory/1976-58-0x00000000001D0000-0x000000000024F000-memory.dmp

Download

memory/1976-60-0x0000000000120000-0x0000000000126000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads