gozi_ifsb | 1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d

Analysis

max time kernel
426s
max time network
431s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26/10/2022, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe
Size

427KB
MD5

128b4eae516413e49231d33d51128e03
SHA1

a3452df7ab16b4906f74fa3be88eb10d32d977d0
SHA256

1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d
SHA512

e097973687612afcb5a0adbb2e4e83755696d7b8ca2f75261651b613fe80b66ad2fe5a64cb80316928707fb7ff4cfbc45bcc457d460fab96384c46212c86eca8
SSDEEP

12288:XoX1leppIDspwgjsCfTuQxc9jO/pj29DcH:XoDDsp1smcdO/pyaH

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Loads dropped DLL 1 IoCs

pid	Process
852	1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 852 set thread context of 1692	852	1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
852	1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1692	852	1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe	27
PID 852 wrote to memory of 1692	852	1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe	27
PID 852 wrote to memory of 1692	852	1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe	27
PID 852 wrote to memory of 1692	852	1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe	27
PID 852 wrote to memory of 1692	852	1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe	27

C:\Users\Admin\AppData\Local\Temp\1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe
"C:\Users\Admin\AppData\Local\Temp\1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:852
- C:\Users\Admin\AppData\Local\Temp\1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe
  "C:\Users\Admin\AppData\Local\Temp\1130e8a4dc91f3b71db894d0088a9ef20422aa7d500b0291568d59c3c013fc4d.exe"
  2⤵
  PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd3BB.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
memory/852-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1692-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1692-59-0x0000000000230000-0x000000000026B000-memory.dmp

Filesize
236KB

Download