gozi_ifsb | 8d2f90927603c33947463dc9846dc1b7a220ea1f13dc1a0ccfe538d5f83bbfe2

Analysis

max time kernel
143s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 22:24

Target
ursnif_IAT_corrected.exe.dll
Size 56KB
Sample221020-2bcwcahcb4
SHA256 8d2f90927603c33947463dc9846dc1b7a220ea1f13dc1a0ccfe538d5f83bbfe2
MD5 8b52c277c63c5877c0e4ca32d1458957
SHA1 1d64f4610c6e0af8a3e3a9d8e8b794fc1bebeef5
SHA512 9f7022155d4764e625fe1a6b5377eed4b2e7620a9bd03c7f5474112de30bb60b7898c5e9a325035544d01c3621bff103f6b857373d146c1f622772e1abbf1b99
SSDEEP 768:A2KGmsx3R69vSvjyRpq63goMWPXE2bE/JVMq2LATqeeAeOu2D2wqmLiu6:wGBx3R6iApqlaPGhVMq2LpeReOb2Pmp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.plain

aes.plain

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3488	2480	regsvr32.exe	82
PID 2480 wrote to memory of 3488	2480	regsvr32.exe	82
PID 2480 wrote to memory of 3488	2480	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ursnif_IAT_corrected.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ursnif_IAT_corrected.exe.dll
  2⤵
  PID:3488

memory/3488-133-0x00000000009F0000-0x00000000009FD000-memory.dmp

Download