gozi_ifsb | b8753f2425f9e029375145992cb20a1c5cf97d9b23208f7069b66436a1296262

Analysis

max time kernel
131s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2022, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b2a58f205e9d64be93358111daf44ef8b497806277dcdfd9097fde9f08a3d4d.dll
Size 492KB
Sample220915-srdcdaddf9
SHA256 5b2a58f205e9d64be93358111daf44ef8b497806277dcdfd9097fde9f08a3d4d
MD5 f1fcae6d0389759fe0ea7a3615638f48
SHA1 e178ddcd2bc6fea8348fcfca3e61053bec47b633
SHA512 6ee61797840f06abdfe5adc5c95766acdd527378e6e9cb8da40dcdd3b148e6af762a182b389c22d6bfb70300e3354c3956dcbbf6503d35ca71eacfd3693a4886
SSDEEP 6144:WxAQREasWxRW9daXTo7rsOldRs7vBfEgaW5aE3V6G9I0rE5RvRb:9QDsoMdPrFdRsjB8MgEX9Irx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com
superstarts.top
superlist.top
internetcoca.in
193.106.191.163

Attributes

base_path
/drew/
build
250240
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Blocklisted process makes network request 3 IoCs

flow	pid	Process
10	2276	rundll32.exe
20	2276	rundll32.exe
35	2276	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2276	4832	rundll32.exe	80
PID 4832 wrote to memory of 2276	4832	rundll32.exe	80
PID 4832 wrote to memory of 2276	4832	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b2a58f205e9d64be93358111daf44ef8b497806277dcdfd9097fde9f08a3d4d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b2a58f205e9d64be93358111daf44ef8b497806277dcdfd9097fde9f08a3d4d.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-133-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2276-135-0x00000000009F0000-0x00000000009F6000-memory.dmp

Download

memory/2276-136-0x0000000000D80000-0x0000000000D8D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads