gozi_ifsb | 539b93f7453bae7aa4bb960cdca9cf90d3b94ca64c0e90b96e4c1b150e843d84

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
29/06/2022, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
862e22c2c3fad4741c689f93686cec6d.dll
Size 428KB
Sample220629-ldmkkaaba3
SHA256 539b93f7453bae7aa4bb960cdca9cf90d3b94ca64c0e90b96e4c1b150e843d84
MD5 862e22c2c3fad4741c689f93686cec6d
SHA1 616999ca7eea175abcea017ecd5cd219a2050da7
SHA512 655c27ff3db5829783cac40f0651dc03c382f5eaf65c5aa770dc829125d6d3d2dc7764e583ddc43d655d66d166628413b1703fa524392c4c24d483a9d9da8e00
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com
194.76.225.112
194.76.225.113
46.21.153.203

Attributes

base_path
/drew/
build
250239
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1652	1068	rundll32.exe	28
PID 1068 wrote to memory of 1652	1068	rundll32.exe	28
PID 1068 wrote to memory of 1652	1068	rundll32.exe	28
PID 1068 wrote to memory of 1652	1068	rundll32.exe	28
PID 1068 wrote to memory of 1652	1068	rundll32.exe	28
PID 1068 wrote to memory of 1652	1068	rundll32.exe	28
PID 1068 wrote to memory of 1652	1068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\862e22c2c3fad4741c689f93686cec6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\862e22c2c3fad4741c689f93686cec6d.dll,#1
  2⤵
  PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Download

memory/1652-56-0x0000000000260000-0x00000000002CD000-memory.dmp

Download

memory/1652-57-0x0000000000260000-0x00000000002CD000-memory.dmp

Download

memory/1652-59-0x0000000000200000-0x000000000020D000-memory.dmp

Download

memory/1652-62-0x0000000000100000-0x0000000000106000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads