gozi | 88de34ad95486071b8796d95150461a8a7968d1eb8817772e892d258f3aa1c91

Resubmissions

24-07-2023 06:52

27-10-2022 16:06

31-08-2022 10:16

max time kernel
143s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 16:06

Target

x.dll
Size

429KB
MD5

f4b0a6ab164f7c58cccce651606caede
SHA1

e893352eb4df504843cb3e8588d59593a9757937
SHA256

88de34ad95486071b8796d95150461a8a7968d1eb8817772e892d258f3aa1c91
SHA512

0a305d740ff8074fb9ed2b501316beee4c33d48f35728665b7fa0f3a2b7b3efb6731ec0e2245e296822a8e640e4f1439c24e1870c4080ac211d4ac11c5de43e5
SSDEEP

12288:yd/Qeei+XrnguJYoeYcWDCkz+oI2u024rn2M24rn2h125HRB:yd//m7nzK262h

Score

10^/10

Family

gozi

Botnet

202208152

https://fishenddog.xyz

https://minotos.xyz

Attributes

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1960 wrote to memory of 1004	1960	regsvr32.exe	cmd.exe
PID 1960 wrote to memory of 1004	1960	regsvr32.exe	cmd.exe
PID 1960 wrote to memory of 1004	1960	regsvr32.exe	cmd.exe
PID 1960 wrote to memory of 1208	1960	regsvr32.exe	cmd.exe
PID 1960 wrote to memory of 1208	1960	regsvr32.exe	cmd.exe
PID 1960 wrote to memory of 1208	1960	regsvr32.exe	cmd.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\x.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\system32\cmd.exe
cmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\C1EC.tmp
2⤵
PID:1004

C:\Windows\system32\cmd.exe
cmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\C1EC.tmp
2⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\C1EC.tmp
Filesize
3KB

MD5
e4741513d73213cb521d60bd9a8aad85

SHA1
11643a455c21e23c3d23210aa8e0f2c340b0a1ae

SHA256
d5796f534cb444e8f8be579a426d9f410d11e76e348b87a3ffbea4b46663b9ee

SHA512
7899bb2700fa1205eeaa61caf718fe21b9aca90527c3ee22cc414914ded94dd04ad79fbfe58b5eeee74fe012ade9cac76a04b8851a911371374072ef30d3f9d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\C1EC.tmp
Filesize
3KB

MD5
e4741513d73213cb521d60bd9a8aad85

SHA1
11643a455c21e23c3d23210aa8e0f2c340b0a1ae

SHA256
d5796f534cb444e8f8be579a426d9f410d11e76e348b87a3ffbea4b46663b9ee

SHA512
7899bb2700fa1205eeaa61caf718fe21b9aca90527c3ee22cc414914ded94dd04ad79fbfe58b5eeee74fe012ade9cac76a04b8851a911371374072ef30d3f9d9

Download Submit
memory/1004-62-0x0000000000000000-mapping.dmp

Download
memory/1208-63-0x0000000000000000-mapping.dmp

Download
memory/1960-54-0x000007FEFC621000-0x000007FEFC623000-memory.dmp

Filesize
8KB

Download
memory/1960-55-0x000007FEF7270000-0x000007FEF72DE000-memory.dmp

Filesize
440KB

Download
memory/1960-56-0x0000000180000000-0x0000000180013000-memory.dmp

Filesize
76KB

Download