gozi_ifsb | 172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297

General

Target

172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
Size

560KB
MD5

809d3b9cdbc7ba8847cc4ef8d8de512d
SHA1

f29d4849a3053efff95c160519ce47cf381f8c03
SHA256

172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297
SHA512

2edc4504bbb2be500b951cef808f9d7c9cb6bdf1cfd5009c01a1bf7ebb2e0b0d2476f6f006ee51e18dc266ab742e52d66946b8a768d26c25ffea8c84fc699354
SSDEEP

12288:FPLRBqplpgxVReAcFcniKUPHwxV3GKydCD:IpYxTeAe5+JEdCD

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of SetThreadContext 1 IoCs

Processes:

172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe

description	pid	process	target process
PID 1100 set thread context of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe

pid process

1100 172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe

pid	process
1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe

C:\Users\Admin\AppData\Local\Temp\172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
"C:\Users\Admin\AppData\Local\Temp\172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100

C:\Users\Admin\AppData\Local\Temp\172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
C:\Users\Admin\AppData\Local\Temp\172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
2⤵
PID:1896

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-62-0x00000000001F0000-0x00000000001F5000-memory.dmp

Filesize
20KB

Download
memory/1100-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1896-64-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-70-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-59-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-56-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-61-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-63-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-55-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/1896-66-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-68-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-57-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-72-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-74-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-76-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-77-0x00000000004010E7-mapping.dmp

Download
memory/1896-80-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-81-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download
memory/1896-82-0x0000000000400000-0x0000000002C3C000-memory.dmp

Filesize
40.2MB

Download

description	pid	process	target process
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe
PID 1100 wrote to memory of 1896	1100	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe	172f359baa478d80a9a8eccde0393e3fb8a58f0444a1b71d99d87c6a50855297.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads