gozi_ifsb | d413a1433725e6ef4572bf2bc66ff86472f7f8cd47e91cf69f65962737f50529 | Triage

Analysis

max time kernel
140s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2022 17:17

Sharing

Report Analysis Logs

General

Target

youWhen.dll
Size

608KB
MD5

d958d62d1704552c7cb44139d4a77076
SHA1

55e288f20be7fd16ce5b47d65d35a7678fb650a7
SHA256

8ff05c030b20e156753c6f330a8eb689ef5fdbaf01496d0b144948a822c17e2c
SHA512

57e9c0943eb724f2b46f6fa6c273c5da3f10c90703bcbbaaae30dd8394e54f54c48db1d14a2b1db4919cf23556e65e744556612a6e62e44ec842de0db29c62d4
SSDEEP

6144:zG93dcjsHUws3C4wj+T+9tiB9Px9uco9v/Br1ykVD0ttjn6Lppx:zyr0ws3sjTiBD9uX/nTQtJsx

Score

10^/10

gozi_ifsb 47470 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

47470

C2

asiorpatms.com

unpeoritas.art

Attributes

build
250234
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

30 3536 rundll32.exe
34 3536 rundll32.exe
45 3536 rundll32.exe
46 3536 rundll32.exe
58 3536 rundll32.exe
59 3536 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4900 wrote to memory of 3536	4900	rundll32.exe	rundll32.exe
PID 4900 wrote to memory of 3536	4900	rundll32.exe	rundll32.exe
PID 4900 wrote to memory of 3536	4900	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\youWhen.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\youWhen.dll,#1
2⤵
- Blocklisted process makes network request
PID:3536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3536-132-0x0000000000000000-mapping.dmp

Download
memory/3536-133-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/3536-135-0x0000000001580000-0x0000000001586000-memory.dmp

Filesize
24KB

Download
memory/3536-136-0x0000000001630000-0x000000000163D000-memory.dmp

Filesize
52KB

Download