gozi_ifsb | 4febb4c594048b1ec2c8cf59711bf727d89bbfdc41e63c80adb12a2ab8aece76

Analysis

max time kernel
473s
max time network
409s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-10-2022 23:52

Target

0a5e359d5f40d0ac9c26e51e73b39b11572cd67ee2719ca855406ad8ed3f270c_unpacked_x64.dll
Size

165KB
MD5

aa81719e70b312681c258cd18540b974
SHA1

5547e6f23a9a848b434c5a0b5e0bf1d81fd94a6b
SHA256

4febb4c594048b1ec2c8cf59711bf727d89bbfdc41e63c80adb12a2ab8aece76
SHA512

97e39be324a1331200890c3255397229481d49243cdf9bed2deab9fabd5d82fbeac932abbdd63cb21d99f85d1622173557a5605f65524952a1edd63237522112
SSDEEP

3072:JAZD+WSebbdnFcftVL9t1H60KQAuNQ5AN1ozJBV/xMLiCL:JKxSe4ftVL9DDKQcqN1ozNod

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1192	1992	rundll32.exe	15
PID 1992 wrote to memory of 1192	1992	rundll32.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1192
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a5e359d5f40d0ac9c26e51e73b39b11572cd67ee2719ca855406ad8ed3f270c_unpacked_x64.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992