gozi_ifsb | 934d35b702d4339f22b374ff4b7ea79daaa8546b7551e3b3bd8493bd8e084515

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
internee/boutiques.dll
Size 116KB
Sample221019-mrbkwsfhal
SHA256 d49394ac9e0a118afe5115a2206d5f815dbc0816f7507a860a297c941f88ebfa
MD5 5e349e9ca45164561cc820c8e76d954f
SHA1 c4f8099027a8a0b26455d4fbc005eff217f3a42c
SHA512 7ee7f456c8e83eedb482800a5cb00c1d5624071c6aacf0e5b14c8656cac9f74b3faee7342bdf89a72e335ca5b4d090d2140a44cef5f29ee20f8b558b12b34548
SSDEEP 3072:u14Nm3YTyepi7bLYB0s7+Ec7V6bW2nnW6rifrQc1+lUmT:mvgwYB0v72n6rQA+b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi_ifsb 5000 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

5000

config.edge.skype.com
onlinetwork.top
linetwork.top

Attributes

base_path
/drew/
build
250246
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1732	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1732	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1732	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1732	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1732	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1732	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1732	1104	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\internee\boutiques.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\internee\boutiques.dll
  2⤵
  PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-54-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Download

memory/1732-56-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Download

memory/1732-57-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/1732-62-0x00000000000E0000-0x00000000000E5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads