gozi_ifsb | 7ae2c953f8142f668650d11f0bc7f042e249ee8456b2255f71a51a84ca94c756

Analysis

Target

tmp.exe
Size

225KB
MD5

4d0774579b6e4be41c687982347b5a41
SHA1

4359e5993bbce3794d0fc1a51a147d2b6b67d7bb
SHA256

7ae2c953f8142f668650d11f0bc7f042e249ee8456b2255f71a51a84ca94c756
SHA512

ee4177f6624cb932f5e5c5cad0c27eabdb9ed7250e8133d177561c79c82bcba43d3d781db2af85d06fb7899f23158e94abb3b143f62ac971234ef617cd784a28

Score

10^/10

Family

gozi_ifsb

Botnet

1500

apghn.msn.com

188.126.76.221

Attributes

rsa_pubkey.plain

aes.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 3112 set thread context of 112 3112 tmp.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1368 3112 WerFault.exe tmp.exe

description	pid	process	target process
PID 3112 set thread context of 112	3112	tmp.exe	AppLaunch.exe

pid	pid_target	process	target process
1368	3112	WerFault.exe	tmp.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 3112 wrote to memory of 112	3112	tmp.exe	AppLaunch.exe
PID 3112 wrote to memory of 112	3112	tmp.exe	AppLaunch.exe
PID 3112 wrote to memory of 112	3112	tmp.exe	AppLaunch.exe
PID 3112 wrote to memory of 112	3112	tmp.exe	AppLaunch.exe
PID 3112 wrote to memory of 112	3112	tmp.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 428
2⤵
- Program crash
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3112 -ip 3112
1⤵
PID:1648

memory/112-130-0x0000000000000000-mapping.dmp

Download
memory/112-131-0x00000000007C0000-0x00000000007CF000-memory.dmp

Filesize
60KB

Download
memory/112-139-0x00000000007C0000-0x00000000007CF000-memory.dmp

Filesize
60KB

Download
memory/112-141-0x00000000008A0000-0x00000000008AD000-memory.dmp

Filesize
52KB

Download
memory/3112-140-0x00000000013FF000-0x0000000001401000-memory.dmp

Filesize
8KB

Download