gozi_ifsb | 0989361dd7c8739827009be27579080b37430dbbb35ac9673b5e33f61505fdff

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2022, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0989361dd7c8739827009be27579080b37430dbbb35ac9673b5e33f61505fdff.exe
Size 73KB
Sample220802-ywph4aafc2
SHA256 0989361dd7c8739827009be27579080b37430dbbb35ac9673b5e33f61505fdff
MD5 ffe4d5c72795afbc92c141cbb716eb64
SHA1 595261c32e5867f0c0589ef2df60639ad9fd6dd5
SHA512 0f753566201f6b8e24bfa3e4dd5aa8bbdaa71fdd5c0ce645e61071601f5e01376b2890323e69dc09d79b4600d7f70bf2b04432a135b4f41d98dea35391e9e27e
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 11111 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

11111

trackingg-protectioon.cdn1.mozilla.net
194.76.225.168
194.76.224.242

Attributes

base_path
/fonts/
build
250240
exe_type
loader
extension
.bak
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
920	WinZip.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	0989361dd7c8739827009be27579080b37430dbbb35ac9673b5e33f61505fdff.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2316	1908	0989361dd7c8739827009be27579080b37430dbbb35ac9673b5e33f61505fdff.exe	84
PID 1908 wrote to memory of 2316	1908	0989361dd7c8739827009be27579080b37430dbbb35ac9673b5e33f61505fdff.exe	84
PID 1908 wrote to memory of 2316	1908	0989361dd7c8739827009be27579080b37430dbbb35ac9673b5e33f61505fdff.exe	84
PID 2316 wrote to memory of 920	2316	cmd.exe	86
PID 2316 wrote to memory of 920	2316	cmd.exe	86
PID 2316 wrote to memory of 920	2316	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\0989361dd7c8739827009be27579080b37430dbbb35ac9673b5e33f61505fdff.exe
"C:\Users\Admin\AppData\Local\Temp\0989361dd7c8739827009be27579080b37430dbbb35ac9673b5e33f61505fdff.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C start C:\Users\%UserName%\Downloads\WinZip.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Users\Admin\Downloads\WinZip.exe
    C:\Users\Admin\Downloads\WinZip.exe
    3⤵
    - Executes dropped EXE
    PID:920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

WinZip.exe

Path C:\Users\Admin\Downloads\WinZip.exe
Size 339KB
SHA256 0bd3e6ebfe1c54467789ec4d574d994e8b5bd54b4bcfa5531a9bd1072b7824a9
MD5 4ee88393891abb32b1b56b5bc890d234
SHA1 20f1a0cbbb74fe3e9b3161e7a006528ecef9b6f5
SHA512 1c63299f1f89c529cca86070a0dd36b8a4b2ee3697bfb338758f8e61051ede0e4f993f6008a4a4c97278087992f78d4ec3aeca914a193932031e238750c622e9
SSDEEP 6144:eqDGnyUZiaiA2OvvI6HhHYQ7AtqkOX2As892i6S8x:fGlhiHOvvZHhHvCqj2As88m8
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinZip.exe

Path C:\Users\Admin\Downloads\WinZip.exe
Size 339KB
SHA256 0bd3e6ebfe1c54467789ec4d574d994e8b5bd54b4bcfa5531a9bd1072b7824a9
MD5 4ee88393891abb32b1b56b5bc890d234
SHA1 20f1a0cbbb74fe3e9b3161e7a006528ecef9b6f5
SHA512 1c63299f1f89c529cca86070a0dd36b8a4b2ee3697bfb338758f8e61051ede0e4f993f6008a4a4c97278087992f78d4ec3aeca914a193932031e238750c622e9
SSDEEP 6144:eqDGnyUZiaiA2OvvI6HhHYQ7AtqkOX2As892i6S8x:fGlhiHOvvZHhHvCqj2As88m8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/920-137-0x0000000000618000-0x0000000000629000-memory.dmp

Download

memory/920-138-0x00000000005C0000-0x00000000005CB000-memory.dmp

Download

memory/920-139-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/920-140-0x00000000005E0000-0x00000000005ED000-memory.dmp

Download

memory/920-143-0x0000000000618000-0x0000000000629000-memory.dmp

Download

memory/920-144-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/1908-132-0x0000000000F40000-0x0000000000F58000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads