gozi_ifsb | 7ae2c953f8142f668650d11f0bc7f042e249ee8456b2255f71a51a84ca94c756

Analysis

Target

tmp.exe
Size

225KB
MD5

4d0774579b6e4be41c687982347b5a41
SHA1

4359e5993bbce3794d0fc1a51a147d2b6b67d7bb
SHA256

7ae2c953f8142f668650d11f0bc7f042e249ee8456b2255f71a51a84ca94c756
SHA512

ee4177f6624cb932f5e5c5cad0c27eabdb9ed7250e8133d177561c79c82bcba43d3d781db2af85d06fb7899f23158e94abb3b143f62ac971234ef617cd784a28

Score

10^/10

Family

gozi_ifsb

Botnet

1500

apghn.msn.com

188.126.76.221

Attributes

rsa_pubkey.plain

aes.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 1836 set thread context of 1980 1836 tmp.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

856 1836 WerFault.exe tmp.exe

description	pid	process	target process
PID 1836 set thread context of 1980	1836	tmp.exe	AppLaunch.exe

pid	pid_target	process	target process
856	1836	WerFault.exe	tmp.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 1836 wrote to memory of 1980	1836	tmp.exe	AppLaunch.exe
PID 1836 wrote to memory of 1980	1836	tmp.exe	AppLaunch.exe
PID 1836 wrote to memory of 1980	1836	tmp.exe	AppLaunch.exe
PID 1836 wrote to memory of 1980	1836	tmp.exe	AppLaunch.exe
PID 1836 wrote to memory of 1980	1836	tmp.exe	AppLaunch.exe
PID 1836 wrote to memory of 1980	1836	tmp.exe	AppLaunch.exe
PID 1836 wrote to memory of 1980	1836	tmp.exe	AppLaunch.exe
PID 1836 wrote to memory of 1980	1836	tmp.exe	AppLaunch.exe
PID 1836 wrote to memory of 1980	1836	tmp.exe	AppLaunch.exe
PID 1836 wrote to memory of 856	1836	tmp.exe	WerFault.exe
PID 1836 wrote to memory of 856	1836	tmp.exe	WerFault.exe
PID 1836 wrote to memory of 856	1836	tmp.exe	WerFault.exe
PID 1836 wrote to memory of 856	1836	tmp.exe	WerFault.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 112
2⤵
- Program crash
PID:856

memory/856-67-0x0000000000000000-mapping.dmp

Download
memory/1980-56-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1980-54-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1980-64-0x0000000000401D58-mapping.dmp

Download
memory/1980-65-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1980-66-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download
memory/1980-68-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1980-69-0x00000000002A0000-0x00000000002AD000-memory.dmp

Filesize
52KB

Download