gozi | 2502a3f8c9a6a8681f9222e93b14e077bf879e3009571c646ee94275bc994d01

Resubmissions

27-10-2022 16:06

221027-tj9w2scfg8 10

25-08-2022 03:54

220825-egalvagbb9 1

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

utdh1.dll
Size

760KB
MD5

d94657449f8d8c165ef88fd93e463134
SHA1

eb5cddacd6764098a20ce18a5e1e52f5e603e4ff
SHA256

2502a3f8c9a6a8681f9222e93b14e077bf879e3009571c646ee94275bc994d01
SHA512

659bc86dbd47d9f99c123db7c78d1bac68e4d592eed8f6d2d9ce5289cbf09bf893f0136a67e41e6dc59e1c826f19d34f8ffbaa5089c28592528ead595cca3ddb
SSDEEP

12288:zCZAm0a9L7/7n/zUo2ThEQNvJZAHx137OyyyQTYzzCuatGfWE24rn2k2H824rn2y:wX9v/7/zYdNvnAR13pyyPa+n2F

Score

10^/10

gozi 202206061 banker ldr4 trojan

Malware Config

Extracted

Family

gozi

Botnet

202206061

https://daydayvin.xyz

https://gigiman.xyz

Attributes

host_keep_time
2
host_shift_time
1
idle_time
1
request_time
10

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1088	1156	regsvr32.exe	26
PID 1156 wrote to memory of 1088	1156	regsvr32.exe	26
PID 1156 wrote to memory of 1088	1156	regsvr32.exe	26
PID 1156 wrote to memory of 828	1156	regsvr32.exe	28
PID 1156 wrote to memory of 828	1156	regsvr32.exe	28
PID 1156 wrote to memory of 828	1156	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\utdh1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\system32\cmd.exe
  cmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\EE28.tmp
  2⤵
  PID:1088
- C:\Windows\system32\cmd.exe
  cmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\EE28.tmp
  2⤵
  PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EE28.tmp

Filesize
11B

MD5
a67f2061c697fd95f6b28d89b953a51f

SHA1
6730b864104f0840fcebf04383d2e3ef7c324a48

SHA256
d4bdd82a900fea52cbd442ce8cae201982392d3533d765bfceb7682bc2d16a79

SHA512
d9cc7c1593967dbcaf358bc9d394426d97baa7bb6ddeed1767b638c85aa814276eaa3609588b720cab3b2a0b3e36d1d3833dab3e75c9c1a92b8315db61a64cbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\EE28.tmp

Filesize
3KB

MD5
c01f2098fab503d57ef742c6ca6680d8

SHA1
aeb71dd4ced18b7b45015f5b1ae24c1916ba5810

SHA256
10f8586621df0419894a8d8c33118d08566eb21e831a6f7e1db683ea5e020a81

SHA512
ab4735f98a7e937f95dae4f9da09bc9b8756949fa5b274290a8947b720d82f540fd105abdea14fefdd3671487df34fe117ad42dcd27b1d69ab0d4d6ca48d8f9d

Download Submit
memory/1156-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1156-55-0x0000000180000000-0x0000000180012000-memory.dmp

Filesize
72KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads