gozi_ifsb | ddb1e53e29471cfec9e3240a0f27b647fb060a41f96192fa3fbc0a07696490c6

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
12/08/2022, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03ff07649176bc724f5ec93c4ec4a0eb6eb5857aefa4b23040c4f1a1ff974097.dll
Size 634KB
Sample220812-armxpsebhl
SHA256 03ff07649176bc724f5ec93c4ec4a0eb6eb5857aefa4b23040c4f1a1ff974097
MD5 4419b2a8f9c21f0ea3192ef2ed634942
SHA1 145974bc0ad6c90158e6ccb188b3588e270084fc
SHA512 e6a69e9b6488622ce5aa531f7ae0e28989b187b198172b0d664cc6e4ebc5062c1ec08983ebf4c1335e415adbf5673a21ec3ab1e5bb0349dad90a8d214ff26abb
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com
79.110.52.8
79.110.52.80
193.106.191.163

Attributes

base_path
/drew/
build
250240
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1052	1936	regsvr32.exe	28
PID 1936 wrote to memory of 1052	1936	regsvr32.exe	28
PID 1936 wrote to memory of 1052	1936	regsvr32.exe	28
PID 1936 wrote to memory of 1052	1936	regsvr32.exe	28
PID 1936 wrote to memory of 1052	1936	regsvr32.exe	28
PID 1936 wrote to memory of 1052	1936	regsvr32.exe	28
PID 1936 wrote to memory of 1052	1936	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\03ff07649176bc724f5ec93c4ec4a0eb6eb5857aefa4b23040c4f1a1ff974097.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\03ff07649176bc724f5ec93c4ec4a0eb6eb5857aefa4b23040c4f1a1ff974097.dll
  2⤵
  PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-56-0x0000000075441000-0x0000000075443000-memory.dmp

Download

memory/1052-57-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/1052-62-0x00000000001D0000-0x00000000001DD000-memory.dmp

Download

memory/1936-54-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads