Overview

overview

10

Static

static

3d3756a6cf...c4.exe

windows7_x64

10

3d3756a6cf...c4.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    144s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    03-07-2022 03:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3d3756a6cf31eec8f9522c88d8c46086acf3241673c2e478e62958f4a6c7dac4.exe

  • Size

    328KB

  • MD5

    bec7a9953133cf5e8a999dfa45ea2014

  • SHA1

    60b698b731e237ae839ec2398c5df987947b4e79

  • SHA256

    3d3756a6cf31eec8f9522c88d8c46086acf3241673c2e478e62958f4a6c7dac4

  • SHA512

    8f1069b6edbb07e8f6ab9697d97b1b20a9bacf426908f0adbab0f862313b3d44a88907eb06e00857c99cb1da83c8b2fe3c4599947bcfbe57d22b02a28819e70e

Score
10/10
gozi_ifsbbankertrojan

Malware Config

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Program crash 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d3756a6cf31eec8f9522c88d8c46086acf3241673c2e478e62958f4a6c7dac4.exe
    "C:\Users\Admin\AppData\Local\Temp\3d3756a6cf31eec8f9522c88d8c46086acf3241673c2e478e62958f4a6c7dac4.exe"
    1⤵
      PID:4416
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 264
        2⤵
        • Program crash
        PID:1344
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 496
        2⤵
        • Program crash
        PID:5012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 508
        2⤵
        • Program crash
        PID:5092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4416 -ip 4416
      1⤵
        PID:2620
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4416 -ip 4416
        1⤵
          PID:4284
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4416 -ip 4416
          1⤵
            PID:3440

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4416-130-0x0000000000610000-0x0000000000649000-memory.dmp
            Filesize

            228KB

            Download
          • memory/4416-131-0x0000000000400000-0x000000000049D000-memory.dmp
            Filesize

            628KB

            Download
          • memory/4416-132-0x00000000001C0000-0x00000000001FB000-memory.dmp
            Filesize

            236KB

            Download
          • memory/4416-139-0x0000000000610000-0x0000000000649000-memory.dmp
            Filesize

            228KB

            Download
          • memory/4416-140-0x0000000000400000-0x000000000049D000-memory.dmp
            Filesize

            628KB

            Download