gozi_ifsb | cfdf3a2bfba750c5fc5b4666f3e4631b4d26e28c901887dbb5e8d8fa5d2e0508

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2022, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
250246f66f72227e185727fce72b98ed.dll
Size 492KB
Sample220831-p7a1eagbf7
SHA256 cfdf3a2bfba750c5fc5b4666f3e4631b4d26e28c901887dbb5e8d8fa5d2e0508
MD5 250246f66f72227e185727fce72b98ed
SHA1 738e48bc8a55982510899fb5c3e80f885b146fb6
SHA512 1da4bd29d8ef1b189e91ab1ae2ded84201e942b02d45bb29542fec5b55b7ff6f675f9e237f33835469d25f9a2431ff79c94c7f0b2ce4f932d10a9c75c2b6641e
SSDEEP 6144:lxAQREasWxRW9daXTo7rsOldRs7vBfEgaW5aJ3V6G9I0rE5RvRb:wQDsoMdPrFdRsjB8MgJX9Irx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com
superstarts.top
superlist.top
internetcoca.in
193.106.191.163

Attributes

base_path
/drew/
build
250240
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Blocklisted process makes network request 3 IoCs

flow	pid	Process
25	3048	rundll32.exe
45	3048	rundll32.exe
83	3048	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3048	4112	rundll32.exe	83
PID 4112 wrote to memory of 3048	4112	rundll32.exe	83
PID 4112 wrote to memory of 3048	4112	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\250246f66f72227e185727fce72b98ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\250246f66f72227e185727fce72b98ed.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-133-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/3048-135-0x0000000000B70000-0x0000000000B76000-memory.dmp

Download

memory/3048-136-0x00000000026A0000-0x00000000026AD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads