gozi_ifsb | 96a5e9be7024b66e3b247ca291159a36eb1003832bb5ffa312555fbcdc4525b8

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2022, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
55539d3435922553f0f50a51ae32b2bf2fede23591f29bcfef1a80698a4cc1a6.dll
Size 492KB
Sample220907-sagcpshfap
SHA256 55539d3435922553f0f50a51ae32b2bf2fede23591f29bcfef1a80698a4cc1a6
MD5 305a0d65b83ad1c1a1aebb5ba55da5e1
SHA1 2f232ac3aaeba57947377fa52e9b7a0ecdf7d824
SHA512 516bf25858a7995ea3438f50ef5485ea496122efeba1b8f3e7e81c22e667ea076301a66384265bcae88f0f5adf4dea4b9b87ea529fba78e153f3c6263417179f
SSDEEP 6144:PxAQREasWxRW9daXTo7rsOldRs7vBfEgaW5ap3V6G9I0rE5RvRb:GQDsoMdPrFdRsjB8MgpX9Irx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com
superstarts.top
superlist.top
internetcoca.in
193.106.191.163

Attributes

base_path
/drew/
build
250240
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Blocklisted process makes network request 3 IoCs

flow	pid	Process
11	1636	rundll32.exe
19	1636	rundll32.exe
24	1636	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1636	3016	rundll32.exe	82
PID 3016 wrote to memory of 1636	3016	rundll32.exe	82
PID 3016 wrote to memory of 1636	3016	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55539d3435922553f0f50a51ae32b2bf2fede23591f29bcfef1a80698a4cc1a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55539d3435922553f0f50a51ae32b2bf2fede23591f29bcfef1a80698a4cc1a6.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-133-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1636-135-0x0000000001110000-0x0000000001116000-memory.dmp

Download

memory/1636-136-0x00000000031E0000-0x00000000031ED000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads