Analysis
-
max time kernel
472s -
max time network
424s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26-10-2022 23:52
General
-
Target
0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked_x64.dll
-
Size
112KB
-
MD5
1d9eb92dee117a6c39a538b2f2c50daa
-
SHA1
4310f5f11fb1259a6d50140959538d202d4aeca0
-
SHA256
deb88e78eb54a0297cd573231a8e0ddfadfced68ba4fbdc3c8ed2e035c52ed30
-
SHA512
1b80694d44e861e1a2b8ecdae90a7c0dd88d0b38e6155f72e55d14cf1f4ff86c79277104f9ced8714f44dfac66978153a36baf7c23faf5fc1c0b1c846868098c
-
SSDEEP
3072:ga3CJcJDyt3l2bOlxBuxNtTWNxltoTDP4BtKu9fj1LmbT:gayJcJfOvBuxqNxcTcK7n
Score
10/10
Malware Config
Signatures
-
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked_x64.dll,#12⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-