gozi_ifsb | bf73958e0621f0240d547483379c8127573b89b992278c64217e472b793a875a | Triage™

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2022, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68ea106b3ff0d710ee9af1271bb8af0636100691c1d08f45036f31a9e29ae688.dll
Size 347KB
Sample220812-brglcsehbn
SHA256 68ea106b3ff0d710ee9af1271bb8af0636100691c1d08f45036f31a9e29ae688
MD5 ed375aaa5a4378c5b4c645da301a43f0
SHA1 bd41b21b1b151e7cb29f129a883b97f2cd94cc21
SHA512 e0926db1fd14df5fba630ce59ced0ab0a49ec402f38bace61b80742aaa9725ea37109dc9729249f341df858454a870dfb0ba74c7173d215579acbf264c0ffb6e
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com
79.110.52.8
79.110.52.80
193.106.191.163

Attributes

base_path
/drew/
build
250240
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 4436	2068	regsvr32.exe	83
PID 2068 wrote to memory of 4436	2068	regsvr32.exe	83
PID 2068 wrote to memory of 4436	2068	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\68ea106b3ff0d710ee9af1271bb8af0636100691c1d08f45036f31a9e29ae688.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\68ea106b3ff0d710ee9af1271bb8af0636100691c1d08f45036f31a9e29ae688.dll
  2⤵
  PID:4436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4436-131-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/4436-136-0x0000000001300000-0x000000000130D000-memory.dmp

Download