gozi | 1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1

Resubmissions

27-10-2022 16:05

20-10-2022 21:03

max time kernel
133s
max time network
146s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 16:05

Target

1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1.dll
Size

973KB
MD5

8c658b9b02814927124351484c42a272
SHA1

85c346b2d6d0306a5bf7f276e82d9984c167e8ea
SHA256

1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1
SHA512

28f9fcd72e5beceef4e7442e7bac02c0b5060c71403af34aabb78f4871c28bfdf88f4a50da8988fbbc07429466db6c05dd4f3292cabedf913ccbd532086deba3
SSDEEP

12288:bDDjN50jO7rPxxYnCOWMrZlTf6ahp+3NV6ZZveATYAyvPzXTwnX1cQ47gcckpPWy:/vf3ZKnZDyYxr6AVIY7wOM058ZxM

Score

10^/10

Family

gozi

Botnet

202206061

https://gigimas.xyz

https://reaso.xyz

Attributes

aes.plain

Family

gozi

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

2 1292 rundll32.exe
4 1292 rundll32.exe
5 1292 rundll32.exe
6 1292 rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1416 wrote to memory of 1292	1416	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 1292	1416	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 1292	1416	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 1292	1416	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 1292	1416	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 1292	1416	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 1292	1416	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1388	1292	rundll32.exe	cmd.exe
PID 1292 wrote to memory of 1388	1292	rundll32.exe	cmd.exe
PID 1292 wrote to memory of 1388	1292	rundll32.exe	cmd.exe
PID 1292 wrote to memory of 1388	1292	rundll32.exe	cmd.exe
PID 1292 wrote to memory of 1956	1292	rundll32.exe	cmd.exe
PID 1292 wrote to memory of 1956	1292	rundll32.exe	cmd.exe
PID 1292 wrote to memory of 1956	1292	rundll32.exe	cmd.exe
PID 1292 wrote to memory of 1956	1292	rundll32.exe	cmd.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\cmd.exe
cmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\58.tmp
3⤵
PID:1388

C:\Windows\SysWOW64\cmd.exe
cmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\58.tmp
3⤵
PID:1956

C:\Users\Admin\AppData\Local\Temp\58.tmp
Filesize
11B

MD5
a67f2061c697fd95f6b28d89b953a51f

SHA1
6730b864104f0840fcebf04383d2e3ef7c324a48

SHA256
d4bdd82a900fea52cbd442ce8cae201982392d3533d765bfceb7682bc2d16a79

SHA512
d9cc7c1593967dbcaf358bc9d394426d97baa7bb6ddeed1767b638c85aa814276eaa3609588b720cab3b2a0b3e36d1d3833dab3e75c9c1a92b8315db61a64cbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\58.tmp
Filesize
3KB

MD5
e31f3b8fe18bd444c7ab1c623f0589d1

SHA1
7fa6b040654d0bf6c49632e040eb3d3062107e91

SHA256
9d180cab1856e20691b5604a3a3a2d3d827e418ac100cafc895998cdff8eefe9

SHA512
4e0ac387b74421fa2248de778889b37ffe57c3eaa27236bffcbaba93638dcc289f6d2459720374105a6b0fc7d3d910adf847e081caa585f31fedbd6cd5e009d1

Download Submit
memory/1292-54-0x0000000000000000-mapping.dmp

Download
memory/1292-55-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1292-56-0x0000000001D40000-0x0000000001E38000-memory.dmp

Filesize
992KB

Download
memory/1292-57-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download
memory/1292-58-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download
memory/1292-59-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/1292-60-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download
memory/1388-61-0x0000000000000000-mapping.dmp

Download
memory/1956-62-0x0000000000000000-mapping.dmp

Download