gozi_ifsb | 64d2a023b1208a01375af17e3b02ff7eebae76d3a35ece915c52e5d7a021edc9 | Triage

Analysis

max time kernel
88s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
30-06-2022 07:10

Sharing

Report Analysis Logs

General

Target

5343f42db6381300f2c970f86feaa7f4.dll
Size

226KB
MD5

e84631873c87ac0af8a0a0802afaafb3
SHA1

d6a37d21ea7bf956a086c03ccbeeb84ffeb758a3
SHA256

64d2a023b1208a01375af17e3b02ff7eebae76d3a35ece915c52e5d7a021edc9
SHA512

3a7da6eab40d580946d7eb01d1bab1920d5eb04044d52fb48300ea9dfd9e057c367f4605065841bdac82b288696a7142b66a6059281118f42a5244be14c94793

Score

10^/10

gozi_ifsb 3000 banker suricata trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com

194.76.225.112

194.76.225.113

46.21.153.203

Attributes

base_path
/drew/
build
250239
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4392 wrote to memory of 4760	4392	regsvr32.exe	regsvr32.exe
PID 4392 wrote to memory of 4760	4392	regsvr32.exe	regsvr32.exe
PID 4392 wrote to memory of 4760	4392	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5343f42db6381300f2c970f86feaa7f4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4392

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5343f42db6381300f2c970f86feaa7f4.dll
2⤵
PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4760-130-0x0000000000000000-mapping.dmp

Download
memory/4760-131-0x0000000000370000-0x000000000037E000-memory.dmp

Filesize
56KB

Download
memory/4760-132-0x00000000003E0000-0x00000000003ED000-memory.dmp

Filesize
52KB

Download
memory/4760-135-0x0000000000370000-0x000000000037E000-memory.dmp

Filesize
56KB

Download