gozi_ifsb | f4848c59b6dab07ec39fba5dd98253fbebd65af0862157e72fa5d1cf3469d7ca

Analysis

Target

f4848c59b6dab07ec39fba5dd98253fbebd65af0862157e72fa5d1cf3469d7ca.dll
Size

696KB
MD5

a908e3261ee99c8fe331293b2fc11d6f
SHA1

a5e8d1183e5d816847913d3c50e1900bf5dd5186
SHA256

f4848c59b6dab07ec39fba5dd98253fbebd65af0862157e72fa5d1cf3469d7ca
SHA512

276d301fbc93ea1457d4d5036cbe48064c34ce4f81a340ee972e575a6f9c4eaf7c0930b79f2409f8a79e1fd8ccb2e48ac84dc57e028fcb3f736298a485917184

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4204 wrote to memory of 3848	4204	rundll32.exe	rundll32.exe
PID 4204 wrote to memory of 3848	4204	rundll32.exe	rundll32.exe
PID 4204 wrote to memory of 3848	4204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4848c59b6dab07ec39fba5dd98253fbebd65af0862157e72fa5d1cf3469d7ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4848c59b6dab07ec39fba5dd98253fbebd65af0862157e72fa5d1cf3469d7ca.dll,#1
2⤵
PID:3848

memory/3848-130-0x0000000000000000-mapping.dmp

Download
memory/3848-131-0x0000000002B90000-0x000000000354C000-memory.dmp

Filesize
9.7MB

Download
memory/3848-132-0x0000000002B91000-0x0000000002C09000-memory.dmp

Filesize
480KB

Download
memory/3848-133-0x0000000002B90000-0x000000000354C000-memory.dmp

Filesize
9.7MB

Download
memory/3848-134-0x0000000002B90000-0x0000000002BDB000-memory.dmp

Filesize
300KB

Download
memory/3848-135-0x0000000002B90000-0x000000000354C000-memory.dmp

Filesize
9.7MB

Download
memory/3848-136-0x0000000003550000-0x000000000359A000-memory.dmp

Filesize
296KB

Download