gozi_ifsb | 20351bf93e117a01a601e5fcd6b83250e42e001a81cc9bf660e3079516a30f08

Analysis

max time kernel
153s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07/07/2022, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a9ee4bc7f3ea02691545e64d9630d68.dll
Size 432KB
Sample220707-lfww1sbabm
SHA256 20351bf93e117a01a601e5fcd6b83250e42e001a81cc9bf660e3079516a30f08
MD5 3a9ee4bc7f3ea02691545e64d9630d68
SHA1 9596b9362933b763c935a37273927d8779293805
SHA512 d4643896737d3d5bd87b5a909d4a08cf5907badc9aa3fcdb77dd05f035a550ca169b92eac8f300a747f04339c4b0aebd3463da567f0348341f0cc27e949389a7
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 3000 banker suricata trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com
79.110.52.164
79.110.52.97

Attributes

base_path
/drew/
build
250239
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
32	4736	rundll32.exe
35	4736	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 4736	460	rundll32.exe	82
PID 460 wrote to memory of 4736	460	rundll32.exe	82
PID 460 wrote to memory of 4736	460	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9ee4bc7f3ea02691545e64d9630d68.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9ee4bc7f3ea02691545e64d9630d68.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4736-131-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4736-133-0x0000000000890000-0x0000000000896000-memory.dmp

Download

memory/4736-134-0x0000000002490000-0x000000000249D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads