gozi_ifsb | 8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1.exe
Size

237KB
MD5

7828f04aee05ad7e4347a68c431b1fb1
SHA1

1ef468bd21702883264cf01fc7412ba681713ccc
SHA256

8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1
SHA512

953d1d7cab60bf73b840a4c5c7b0f24ffc8f7a3cca62595ba933a9a4a590f7549a62fc839ebfdab2d152804b3f1eb876c47553e05451d71f5ac1d7bb9cdbef4c
SSDEEP

6144:1QmqVJbaflmsnFJlJfn5WsR4t5n3jJ9ZMjvA5wG:1GnKF1f5W24t5t9Z2vA

Score

10^/10

gozi_ifsb 3 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

rootapi.su

root-api.su

rootapigoogle.su

rootapi-google.su

root-apigoogle.su

rootgoogle.su

root-google.su

rootgoogleapi.su

rootgoogle-api.su

root-googleapi.su

91.226.212.148

Attributes

exe_type
worker

rsa_pubkey.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

328 1096 WerFault.exe 8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1.exe

pid	pid_target	process	target process
328	1096	WerFault.exe	8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1.exe

description	pid	process	target process
PID 1096 wrote to memory of 328	1096	8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1.exe	WerFault.exe
PID 1096 wrote to memory of 328	1096	8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1.exe	WerFault.exe
PID 1096 wrote to memory of 328	1096	8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1.exe	WerFault.exe
PID 1096 wrote to memory of 328	1096	8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1.exe
"C:\Users\Admin\AppData\Local\Temp\8c340810b289bb9addfc9edb7c6dcd47d9f990135bac7b43406a985383b71da1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 132
2⤵
- Program crash
PID:328

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-56-0x0000000000000000-mapping.dmp

Download
memory/1096-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1096-55-0x0000000000160000-0x000000000018F000-memory.dmp

Filesize
188KB

Download