Analysis
- max time kernel
599s - max time network
511s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
26/10/2022, 23:52
General
- Target 0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked_x64.dll
- Size 112KB
- Sample221026-3w34psaahk
- SHA256 deb88e78eb54a0297cd573231a8e0ddfadfced68ba4fbdc3c8ed2e035c52ed30
Score
10/10
Malware Config
Signatures
- Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked_x64.dll,#12⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-