gozi_ifsb | 4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4

General

Target

4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Size

603KB
MD5

7e223a197b4fa1c64ea0b79efe0a9225
SHA1

8122818f2b63ba34faf0bc3c0fbe3184a91a67ab
SHA256

4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4
SHA512

9862e03d94791027d4c2bcde4da94bd273ab5ba10397c87897f62d219251c86ef5618e1fc21020979f853bb13cbda090c770ce0f27b7323cd71a4766e0c4708e
SSDEEP

12288:dkEkVwdpywnVtAxRgP8b1uHOJC60Jpd8dOgvpe59HAw:dkh6dpj8LgPiR0ndEtsGw

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe

description	pid	process
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
Token: SeTcbPrivilege	1536	4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe

C:\Users\Admin\AppData\Local\Temp\4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
"C:\Users\Admin\AppData\Local\Temp\4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1536-55-0x00000000026B0000-0x00000000026DB000-memory.dmp

Filesize
172KB

Download
memory/1536-56-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1536-58-0x00000000026B0000-0x00000000026DB000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads