gozi_ifsb | 8e570e32acb99abfd0daf62cff13a09eb694ebfa633a365d224aefc6449f97de

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/08/2022, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
makeAbout.dll
Size 351KB
Sample220826-kvfb5saagq
SHA256 8e570e32acb99abfd0daf62cff13a09eb694ebfa633a365d224aefc6449f97de
MD5 60375d64a9a496e220b6eb1b63e899b3
SHA1 d1b2dd93026b83672118940df78a41e2ee02be80
SHA512 94dd11ffac54db7301572688958a7e8c0a8486a614370dc5e78a0148c31bfbdc856dc8313ea8b06e0ed6d7e57b45e649af72bba56723b96e1269dfec5e0dcc5f
SSDEEP 6144:S5UwskH5M4JuJAGEshm9uu7tDC/vjalCX6hBydwErnZJ2hVmv3Itrfq/mENG1w2O:oUwJHGYTZhVyYtmNNEw2nSl5rrPZh5Mx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com
superstarts.top
superlist.top
internetcoca.in
193.106.191.163

Attributes

base_path
/drew/
build
250240
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1692	740	regsvr32.exe	27
PID 740 wrote to memory of 1692	740	regsvr32.exe	27
PID 740 wrote to memory of 1692	740	regsvr32.exe	27
PID 740 wrote to memory of 1692	740	regsvr32.exe	27
PID 740 wrote to memory of 1692	740	regsvr32.exe	27
PID 740 wrote to memory of 1692	740	regsvr32.exe	27
PID 740 wrote to memory of 1692	740	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\makeAbout.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\makeAbout.dll
  2⤵
  PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-54-0x000007FEFB9B1000-0x000007FEFB9B3000-memory.dmp

Download

memory/1692-56-0x0000000075A81000-0x0000000075A83000-memory.dmp

Download

memory/1692-57-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/1692-62-0x00000000001A0000-0x00000000001AD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads