gozi_ifsb | 4eef8b6a5bcd808cd0ab0e33efcea2c2f9a36abe556e56556de8550383c9d3ce

Analysis

Target

93114ecf1b2c711ec10e1fafdc834393efc11a97.dll
Size

445KB
MD5

f3be390b01c85970deeae124ca36ce2d
SHA1

93114ecf1b2c711ec10e1fafdc834393efc11a97
SHA256

4eef8b6a5bcd808cd0ab0e33efcea2c2f9a36abe556e56556de8550383c9d3ce
SHA512

463829e0a07a2983d967483d49dd478243658c0be583bcddb801cd45beb869eee8cda812ea3a74e5cf5d70be07b5a59677317dbadcefdb8a21de3ddcbe7fa3a6

Score

10^/10

Family

gozi_ifsb

Botnet

1500

gtr.antoinfer.com

app.bighomegl.at

Attributes

rsa_pubkey.plain

aes.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1964 wrote to memory of 1956	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1956	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1956	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1956	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1956	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1956	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1956	1964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93114ecf1b2c711ec10e1fafdc834393efc11a97.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93114ecf1b2c711ec10e1fafdc834393efc11a97.dll,#1
2⤵
PID:1956

memory/1956-54-0x0000000000000000-mapping.dmp

Download
memory/1956-55-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000074D40000-0x0000000074D4D000-memory.dmp

Filesize
52KB

Download
memory/1956-57-0x0000000074D40000-0x0000000074E4A000-memory.dmp

Filesize
1.0MB

Download
memory/1956-58-0x0000000074D40000-0x0000000074E4A000-memory.dmp

Filesize
1.0MB

Download
memory/1956-59-0x0000000074D40000-0x0000000074E4A000-memory.dmp

Filesize
1.0MB

Download