gozi_ifsb | f65d89d469a51ea178d198fc3fd9123c63937daa6129d35f872769a85aa479e9 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
29-06-2022 19:54

Sharing

Report Analysis Logs

General

Target

64d2a023b1208a01375af17e3b02ff7eebae76d3a35ece915c52e5d7a021edc9.dll
Size

226KB
MD5

e84631873c87ac0af8a0a0802afaafb3
SHA1

d6a37d21ea7bf956a086c03ccbeeb84ffeb758a3
SHA256

64d2a023b1208a01375af17e3b02ff7eebae76d3a35ece915c52e5d7a021edc9
SHA512

3a7da6eab40d580946d7eb01d1bab1920d5eb04044d52fb48300ea9dfd9e057c367f4605065841bdac82b288696a7142b66a6059281118f42a5244be14c94793

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com

194.76.225.112

194.76.225.113

46.21.153.203

Attributes

base_path
/drew/
build
250239
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1864 wrote to memory of 1492	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1492	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1492	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1492	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1492	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1492	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1492	1864	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\64d2a023b1208a01375af17e3b02ff7eebae76d3a35ece915c52e5d7a021edc9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\64d2a023b1208a01375af17e3b02ff7eebae76d3a35ece915c52e5d7a021edc9.dll
  2⤵
  PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-55-0x0000000000000000-mapping.dmp

Download
memory/1492-56-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1492-57-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/1492-58-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/1864-54-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmp

Filesize
8KB

Download