gozi_ifsb | 466281284c21f14e72173ebc3d11e7c577bd4fcdf71fdeb0a82f87f566019092

Analysis

max time kernel
495s
max time network
499s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2022 00:07

Target

4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4_unpacked.dll
Size

281KB
MD5

e1bd43809540a6e8e4f0fe0a25967ec8
SHA1

ff8fa94257287ce61f0d0bd506d6f3e24c4051bf
SHA256

466281284c21f14e72173ebc3d11e7c577bd4fcdf71fdeb0a82f87f566019092
SHA512

b78ac0cd7e69c1d7df73cceb0feb7d2f4298fa8ff2c0be5ea7520e8fb43156f30a73e43640524c3dd42c6cf4a391f24bc116b198be17a95cdb650294dcde8242
SSDEEP

6144:nR3xMuDPZlxVMqlalkZWsu3dbEOdYfB1yYgaoObkC7SnIAzP4rMX:J3DMqglko1pBYmYacp7SnIQ1X

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2696 wrote to memory of 4580	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 4580	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 4580	2696	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4_unpacked.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4_unpacked.dll,#1
  2⤵
  PID:4580