gozi_ifsb | f58f9c8e6a62223efa263da10850e188004471cb2be65264b7f91f27ebab0766

Analysis

max time kernel
126s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17/05/2022, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
62835e34e60c1.dll
Size 432KB
Sample220517-khkfbscbbl
SHA256 f58f9c8e6a62223efa263da10850e188004471cb2be65264b7f91f27ebab0766
MD5 5572213d17be7de71f36fa68eb6808a8
SHA1 5e8b27d57f6c9dc02cf2e30d47f8ed439f0fa20e
SHA512 f015eb3c633c916227b19dc1e446d189ce8ebbb82cadf1c71d962e9d67d8d43defef437f0cb41974173e14c8fdc65808c74e4baacc723ecf0d4c87078566334d
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com
185.189.151.28
185.189.151.70

Attributes

base_path
/drew/
build
250229
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Blocklisted process makes network request 2 IoCs

flow	pid	Process
30	2832	rundll32.exe
35	2832	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2832	2852	rundll32.exe	81
PID 2852 wrote to memory of 2832	2852	rundll32.exe	81
PID 2852 wrote to memory of 2832	2852	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62835e34e60c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62835e34e60c1.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-131-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2832-133-0x0000000000DE0000-0x0000000000DE6000-memory.dmp