gozi_ifsb | 11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845

General

Target

11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
Size

308KB
MD5

434e2060c3650402e75bfce4b8f6034e
SHA1

0afdf4a1eabd95380e045111fb4f76f170e38ee4
SHA256

11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845
SHA512

e755ddbb3bd122fc96a6e7dd8e89d58cfceb57922bb8affff4ad7cb834b776b6e9e0cad5be7f6157231b13833f094fe7b1dfa2f1cc79d141d323b97a86e4e979

Score

10^/10

gozi_ifsb 1010 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1010

C2

sys.mohitsagarmusic.com/bcms/assets/img

sys.dylanlake653.com/bcms/assets/img

sys.cozmoattire.com/bcms/assets/img

sys.nahualbrand.com/bcms/assets/img

lansystemstat.com/bcms/assets/img

highnetwork.pw/bcms/assets/img

lostnetwork.in/bcms/assets/img

sysconnections.net/bcms/assets/img

lansupports.com/bcms/assets/img

Attributes

exe_type
worker
server_id
35

rsa_pubkey.plain

serpent.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of SetThreadContext 1 IoCs

Processes:

11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe

description	pid	process	target process
PID 2420 set thread context of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe

pid process

2420 11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe

pid	process
2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe

description	pid	process	target process
PID 2420 wrote to memory of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
PID 2420 wrote to memory of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
PID 2420 wrote to memory of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
PID 2420 wrote to memory of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
PID 2420 wrote to memory of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
PID 2420 wrote to memory of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
PID 2420 wrote to memory of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
PID 2420 wrote to memory of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
PID 2420 wrote to memory of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
PID 2420 wrote to memory of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
PID 2420 wrote to memory of 2360	2420	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe	11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe

C:\Users\Admin\AppData\Local\Temp\11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
"C:\Users\Admin\AppData\Local\Temp\11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420

C:\Users\Admin\AppData\Local\Temp\11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe
"C:\Users\Admin\AppData\Local\Temp\11c554a1ed8952b63677542071f87a7349d0d508371e61236c82b3de62ce8845.exe"
2⤵
PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-132-0x0000000000000000-mapping.dmp

Download
memory/2360-133-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2360-135-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2360-136-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2360-137-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing