gozi_ifsb | 907db4913759546d4f1cc76c09e6e60fef059938ace8ccc6eab66c17b2627bb0 | Triage™

Analysis

max time kernel
144s
max time network
146s
platform
windows10_x64
resource
win10-20220414-en
submitted
22/04/2022, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
907db4913759546d4f1cc76c09e6e60fef059938ace8ccc6eab66c17b2627bb0.dll
Size 625KB
Sample220422-s186eahhbp
SHA256 907db4913759546d4f1cc76c09e6e60fef059938ace8ccc6eab66c17b2627bb0
MD5 84086647c61fd293c91ad3cf6e07aa3b
SHA1 b0ea9ede4e571c9d8a531cecdbba7b7a50626bb2
SHA512 fd150fe6ed6731fb81b40f8349deaa9e20f92b407a58a24f78b424a956328bb6680b45c9d6d2900d459f4801596db2638bf7a5c2bf887002dbae0d7a9b2e9b48
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 999 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

999

C2

config.edge.skype.com
146.70.35.138
146.70.35.142

Attributes

base_path
/phpadmin/
build
250227
exe_type
loader
extension
.src
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 580	1344	rundll32.exe	66
PID 1344 wrote to memory of 580	1344	rundll32.exe	66
PID 1344 wrote to memory of 580	1344	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\907db4913759546d4f1cc76c09e6e60fef059938ace8ccc6eab66c17b2627bb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\907db4913759546d4f1cc76c09e6e60fef059938ace8ccc6eab66c17b2627bb0.dll,#1
  2⤵
  PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-118-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/580-120-0x0000000002D00000-0x0000000002D06000-memory.dmp

Download