gozi | 1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1

Resubmissions

27/10/2022, 16:05

221027-tjzfbacfg510

20/10/2022, 21:03

221020-zv75gsedhj8

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 16:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1.dll
Size 973KB
Sample221027-tjzfbacfg5
SHA256 1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1
MD5 8c658b9b02814927124351484c42a272
SHA1 85c346b2d6d0306a5bf7f276e82d9984c167e8ea
SHA512 28f9fcd72e5beceef4e7442e7bac02c0b5060c71403af34aabb78f4871c28bfdf88f4a50da8988fbbc07429466db6c05dd4f3292cabedf913ccbd532086deba3
SSDEEP 12288:bDDjN50jO7rPxxYnCOWMrZlTf6ahp+3NV6ZZveATYAyvPzXTwnX1cQ47gcckpPWy:/vf3ZKnZDyYxr6AVIY7wOM058ZxM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi 202206061 banker ldr4 trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

202206061

https://gigimas.xyz
https://reaso.xyz

Attributes

host_keep_time
60
host_shift_time
60
idle_time
20
request_time
10

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 3032	1872	rundll32.exe	82
PID 1872 wrote to memory of 3032	1872	rundll32.exe	82
PID 1872 wrote to memory of 3032	1872	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1480777c361ac1d398cc26c90215de629733f66d60dcbd5970700db0ce786ae1.dll,#1
  2⤵
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-133-0x0000000002760000-0x000000000276E000-memory.dmp

Download

memory/3032-134-0x0000000002780000-0x000000000278F000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads