gozi_ifsb | c7cdacaa77c2dc202b23d8054cdcc966f08ca76b2cba42e944e312bbb25f1168 | Triage

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
01-07-2022 03:31

Sharing

Report Analysis Logs

General

Target

c7cdacaa77c2dc202b23d8054cdcc966f08ca76b2cba42e944e312bbb25f1168.exe
Size

1.6MB
MD5

216e5afebd3ba902505cbed029fef726
SHA1

dc73a4427bbd0e6c9e7f0ed74337a730194986a2
SHA256

c7cdacaa77c2dc202b23d8054cdcc966f08ca76b2cba42e944e312bbb25f1168
SHA512

4455be7350eb81adb03ec593b387ded5c005d319567398f6bbe61f4878e5907814742e49a5748d4c798c70fc37d796b72121f3886f2fd7f779062617a2f60305

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Attributes

build
217025

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c7cdacaa77c2dc202b23d8054cdcc966f08ca76b2cba42e944e312bbb25f1168.exe

pid process

2220 c7cdacaa77c2dc202b23d8054cdcc966f08ca76b2cba42e944e312bbb25f1168.exe

C:\Users\Admin\AppData\Local\Temp\c7cdacaa77c2dc202b23d8054cdcc966f08ca76b2cba42e944e312bbb25f1168.exe
"C:\Users\Admin\AppData\Local\Temp\c7cdacaa77c2dc202b23d8054cdcc966f08ca76b2cba42e944e312bbb25f1168.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-130-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/2220-131-0x0000000002BC0000-0x0000000002C40000-memory.dmp

Filesize
512KB

Download
memory/2220-132-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download