Overview

overview

10

Static

static

4b37304280...b4.exe

windows7-x64

10

4b37304280...b4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    481s
  • max time network
    483s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-10-2022 00:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe

  • Size

    603KB

  • MD5

    7e223a197b4fa1c64ea0b79efe0a9225

  • SHA1

    8122818f2b63ba34faf0bc3c0fbe3184a91a67ab

  • SHA256

    4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4

  • SHA512

    9862e03d94791027d4c2bcde4da94bd273ab5ba10397c87897f62d219251c86ef5618e1fc21020979f853bb13cbda090c770ce0f27b7323cd71a4766e0c4708e

  • SSDEEP

    12288:dkEkVwdpywnVtAxRgP8b1uHOJC60Jpd8dOgvpe59HAw:dkh6dpj8LgPiR0ndEtsGw

Score
10/10
gozi_ifsbbankertrojan

Malware Config

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe
    "C:\Users\Admin\AppData\Local\Temp\4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4108-132-0x0000000002400000-0x000000000242B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/4108-133-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/4108-135-0x0000000002400000-0x000000000242B000-memory.dmp

    Filesize

    172KB

    Download