gozi_ifsb | 1277c4177d2b564b221a369c587c6a99558253234f37bfbf19fef3a63bce88b5 | Triage™

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2022, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
31a1197c1f7a1cb2b53bd1bb7fe2e1f8.dll
Size 300KB
Sample220810-rz96msbdhp
SHA256 1277c4177d2b564b221a369c587c6a99558253234f37bfbf19fef3a63bce88b5
MD5 31a1197c1f7a1cb2b53bd1bb7fe2e1f8
SHA1 b30bf29948b2905db6b106d868b334e423ff4ebe
SHA512 6e65cada52581339a702ae83b63c83a2b52a8982b30b117042cec5e7fac44c61e27d2286ecc3d3fb89ed04ad4bef8414183d0bdd81c109a656b0e158f82b4ef7
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com
79.110.52.8
79.110.52.80
193.106.191.163

Attributes

base_path
/drew/
build
250240
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 1488	5032	regsvr32.exe	82
PID 5032 wrote to memory of 1488	5032	regsvr32.exe	82
PID 5032 wrote to memory of 1488	5032	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\31a1197c1f7a1cb2b53bd1bb7fe2e1f8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\31a1197c1f7a1cb2b53bd1bb7fe2e1f8.dll
  2⤵
  PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-131-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/1488-136-0x00000000008A0000-0x00000000008AD000-memory.dmp

Download