gozi_ifsb | ea33608b909525aa0273e2afa350f081af19426bebb37ce30bea91e2f6374a44

Analysis

max time kernel
480s
max time network
431s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 00:07

Target

3237ec73a4f16533fd2c3fb92b3caf43e42b5c9f11d61a5f8576a86c478f0b55_unpacked_x64.dll
Size

136KB
MD5

8de57105a5e61088a78b9cb96f8ca0d4
SHA1

e6215f1c006f79f7dc519fc96d4e1b35d970d486
SHA256

ea33608b909525aa0273e2afa350f081af19426bebb37ce30bea91e2f6374a44
SHA512

acaea8833ef1a3f297423fc8cc24e140f12857daf2898b42678589036b928a3f49077875a465660f499d0ec0b90291e6dd42144d3e281adf67f50ec64b4dc315
SSDEEP

3072:dqyk+pnRBTZ5hUC6lVUtWsMcig8OtQ5Amyosb/K3x9:dXnbTNalutccig8Dqmyosm

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1380 Explorer.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Explorer.EXE

description pid process

Token: SeShutdownPrivilege 1380 Explorer.EXE
Token: SeShutdownPrivilege 1380 Explorer.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1380 Explorer.EXE
1380 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1380 Explorer.EXE
1380 Explorer.EXE

pid	process
1380	Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	1380	Explorer.EXE
Token: SeShutdownPrivilege	1380	Explorer.EXE

pid	process
1380	Explorer.EXE
1380	Explorer.EXE

pid	process
1380	Explorer.EXE
1380	Explorer.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1988 wrote to memory of 1380	1988	rundll32.exe	Explorer.EXE
PID 1988 wrote to memory of 1380	1988	rundll32.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1380
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3237ec73a4f16533fd2c3fb92b3caf43e42b5c9f11d61a5f8576a86c478f0b55_unpacked_x64.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988