gozi_ifsb | 4febb4c594048b1ec2c8cf59711bf727d89bbfdc41e63c80adb12a2ab8aece76

Analysis

max time kernel
599s
max time network
497s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2022 23:52

Target

0a5e359d5f40d0ac9c26e51e73b39b11572cd67ee2719ca855406ad8ed3f270c_unpacked_x64.dll
Size

165KB
MD5

aa81719e70b312681c258cd18540b974
SHA1

5547e6f23a9a848b434c5a0b5e0bf1d81fd94a6b
SHA256

4febb4c594048b1ec2c8cf59711bf727d89bbfdc41e63c80adb12a2ab8aece76
SHA512

97e39be324a1331200890c3255397229481d49243cdf9bed2deab9fabd5d82fbeac932abbdd63cb21d99f85d1622173557a5605f65524952a1edd63237522112
SSDEEP

3072:JAZD+WSebbdnFcftVL9t1H60KQAuNQ5AN1ozJBV/xMLiCL:JKxSe4ftVL9DDKQcqN1ozNod

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
652	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	652	Explorer.EXE
Token: SeCreatePagefilePrivilege	652	Explorer.EXE
Token: SeShutdownPrivilege	652	Explorer.EXE
Token: SeCreatePagefilePrivilege	652	Explorer.EXE
Token: SeShutdownPrivilege	652	Explorer.EXE
Token: SeCreatePagefilePrivilege	652	Explorer.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 652	1664	rundll32.exe	37
PID 1664 wrote to memory of 652	1664	rundll32.exe	37

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a5e359d5f40d0ac9c26e51e73b39b11572cd67ee2719ca855406ad8ed3f270c_unpacked_x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664