gozi_ifsb | 3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd

Analysis

max time kernel
91s
max time network
43s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-07-2022 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd.exe
Size

669KB
MD5

5bdd37edd3740a4e2da2e05abdc20a20
SHA1

14a801ea2d38259bb50846bedd10229077146b14
SHA256

3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd
SHA512

b6bdebed1594b6dbbf437bbfbe9d57d83345879da00a661d960f2971096c1898bbca6756d7ccdaf88997adbfc621a4e0b6de6dcc3b18a8c9acf6c7fb34d1d4f3

Score

10^/10

gozi_ifsb banker persistence trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd.exe"	3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd.exe

pid process

1552 3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd.exe

pid	process
1552	3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd.exe

C:\Users\Admin\AppData\Local\Temp\3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd.exe
"C:\Users\Admin\AppData\Local\Temp\3d61067831e54523401557f16f776796142f313f41b2b12d48b017a7e06b48dd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1552

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-54-0x00000000759E1000-0x00000000759E3000-memory.dmp

Filesize
8KB

Download
memory/1552-55-0x000000000E900000-0x000000000E93A000-memory.dmp

Filesize
232KB

Download
memory/1552-56-0x000000000ED00000-0x000000000ED44000-memory.dmp

Filesize
272KB

Download