gozi_ifsb | 274171362e7928c3e70241f0d282a8d661cb16c41c787d3006a1810c0f76299f

Analysis

max time kernel
429s
max time network
433s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 04:16

Target

53f7d917ad9ebf5b7d2ccc1a835083bc0c0b92cc69ee584703ea6e4345f5c457_unpacked.dll
Size

367KB
MD5

75b2ecdb38a1a89a620edd99219ba89a
SHA1

cd4a73173a115514dfa71c5b2d611ed955d1b2a3
SHA256

274171362e7928c3e70241f0d282a8d661cb16c41c787d3006a1810c0f76299f
SHA512

073776ad6c1a175584d7aefe5b09c2131f29bcfd6086e57d5bd9653463128f51d93b91c5ea260d21ccd593a48bf4ae73c06679d7e6ed17f83adc3e0225d862a7
SSDEEP

6144:Tckh9rP7lRaXoQ9khE2EiWrqkduoQeqlalrnB4AhdNorGvHdbi09GJGF6iO8:ThPa4rbzguoQeqglSAHhlyR

Score

10^/10

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1044 wrote to memory of 1412	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1412	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1412	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1412	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1412	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1412	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1412	1044	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53f7d917ad9ebf5b7d2ccc1a835083bc0c0b92cc69ee584703ea6e4345f5c457_unpacked.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53f7d917ad9ebf5b7d2ccc1a835083bc0c0b92cc69ee584703ea6e4345f5c457_unpacked.dll,#1
  2⤵
  PID:1412

memory/1412-54-0x0000000000000000-mapping.dmp

Download
memory/1412-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download