gozi_ifsb | b2c2a3ec4991696c24d0fb3b8b9b12c7b1cd3f68826b457bc995007f06aae586 | Triage™

Analysis

max time kernel
142s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2022, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92afccb1071aad0cf08b9116daa54d93a1e1767e09fd3c8192e577313b997b08.dll
Size 376KB
Sample220812-azyn6sechj
SHA256 92afccb1071aad0cf08b9116daa54d93a1e1767e09fd3c8192e577313b997b08
MD5 ead9dccda0c952a77dfcbdab50f99f33
SHA1 43361b1205a2642587c41da75708fd31b130d3e7
SHA512 09f88dd1d12d288ed283e41c7473d239d97d7f571f439a72c47173382e7f68e34e362926ed08bb4a04a9ca6c883924366a648169217ea60972f233369945fe00
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com
79.110.52.8
79.110.52.80
193.106.191.163

Attributes

base_path
/drew/
build
250240
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 624	4800	regsvr32.exe	80
PID 4800 wrote to memory of 624	4800	regsvr32.exe	80
PID 4800 wrote to memory of 624	4800	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\92afccb1071aad0cf08b9116daa54d93a1e1767e09fd3c8192e577313b997b08.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\92afccb1071aad0cf08b9116daa54d93a1e1767e09fd3c8192e577313b997b08.dll
  2⤵
  PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-133-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/624-138-0x0000000000910000-0x000000000091D000-memory.dmp

Download