gozi_ifsb | e192656ce9c73ac7bcb4cec136378c5843e128b76cd1c021aeec274edecbf869 | Triage™

Analysis

max time kernel
125s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2022, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
62f24e6f4c4c7.dll
Size 607KB
Sample220809-pc6tlaaadm
SHA256 e192656ce9c73ac7bcb4cec136378c5843e128b76cd1c021aeec274edecbf869
MD5 62cdd734fdd2d50b1f36f16dac017061
SHA1 bacbec8f116f3e5274693cf7ba6de5c83fb3d9a8
SHA512 2e11dd12f87781d226824de7286237d94d3ba5e77b2c189d5a3e6418d55a4c9689e8890e2734f6476b0893253a6993dc3aca261fd11bd7d2e05760e138daa467
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com
79.110.52.8
79.110.52.80
193.106.191.163

Attributes

base_path
/drew/
build
250240
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 3568	4724	regsvr32.exe	81
PID 4724 wrote to memory of 3568	4724	regsvr32.exe	81
PID 4724 wrote to memory of 3568	4724	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\62f24e6f4c4c7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\62f24e6f4c4c7.dll
  2⤵
  PID:3568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3568-131-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/3568-136-0x0000000002910000-0x000000000291D000-memory.dmp

Download