gozi_ifsb | 3d37a039f510721efc2a3b8970ec02bb1805459acf9f898c490f9417972987bf

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-09-2022 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63297b019069d.dll
Size

504KB
MD5

d9af455fda42e5338a154d5b6abbce7c
SHA1

27023986e041140313474bb255f0dc1be03ac277
SHA256

3d37a039f510721efc2a3b8970ec02bb1805459acf9f898c490f9417972987bf
SHA512

75ed1c03027051d7838911b65948d5854bfb857598dc5cf739ed19bad49e85237c75b76ab7de17b1f91b43a88b00a91f441b17c8db93aa23ad3c17fbe937621e
SSDEEP

6144:/EZjSPANWjOuuPdo4JrNOiduRVBVSjcdZ0nPjlv7oppo7490BszloJ5ICZO/+:KdlJOkuRVfa48LljoppoE90Co5dL

Score

10^/10

gozi_ifsb 3000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

config.edge.skype.com

89.41.26.99

89.45.4.102

193.106.191.163

interstarts.top

superlist.top

internetcoca.in

Attributes

base_path
/drew/
build
250246
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 856 wrote to memory of 272	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 272	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 272	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 272	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 272	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 272	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 272	856	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63297b019069d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63297b019069d.dll,#1
2⤵
PID:272

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/272-54-0x0000000000000000-mapping.dmp

Download
memory/272-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/272-56-0x0000000000750000-0x00000000007D0000-memory.dmp

Filesize
512KB

Download
memory/272-58-0x0000000000750000-0x00000000007D0000-memory.dmp

Filesize
512KB

Download
memory/272-60-0x0000000000240000-0x000000000024D000-memory.dmp

Filesize
52KB

Download
memory/272-63-0x00000000000C0000-0x00000000000C6000-memory.dmp

Filesize
24KB

Download