gozi_ifsb | d413a1433725e6ef4572bf2bc66ff86472f7f8cd47e91cf69f65962737f50529

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09-09-2022 17:17

Target

youWhen.dll
Size

608KB
MD5

d958d62d1704552c7cb44139d4a77076
SHA1

55e288f20be7fd16ce5b47d65d35a7678fb650a7
SHA256

8ff05c030b20e156753c6f330a8eb689ef5fdbaf01496d0b144948a822c17e2c
SHA512

57e9c0943eb724f2b46f6fa6c273c5da3f10c90703bcbbaaae30dd8394e54f54c48db1d14a2b1db4919cf23556e65e744556612a6e62e44ec842de0db29c62d4
SSDEEP

6144:zG93dcjsHUws3C4wj+T+9tiB9Px9uco9v/Br1ykVD0ttjn6Lppx:zyr0ws3sjTiBD9uX/nTQtJsx

Score

10^/10

Family

gozi_ifsb

Botnet

47470

asiorpatms.com

unpeoritas.art

Attributes

rsa_pubkey.plain

aes.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1812	1600	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\youWhen.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\youWhen.dll,#1
2⤵
PID:1812

memory/1812-54-0x0000000000000000-mapping.dmp

Download
memory/1812-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1812-56-0x0000000001D20000-0x0000000001DBB000-memory.dmp

Filesize
620KB

Download
memory/1812-58-0x0000000001D20000-0x0000000001DBB000-memory.dmp

Filesize
620KB

Download
memory/1812-60-0x00000000000F0000-0x00000000000F6000-memory.dmp

Filesize
24KB

Download
memory/1812-61-0x0000000000120000-0x000000000012D000-memory.dmp

Filesize
52KB

Download