gozi | d2fc2e2b90b23c2a91e144fd8ac22668dd682f7d0145963615203d087c48aca4

Resubmissions

27-10-2022 16:06

05-07-2022 12:49

max time kernel
129s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 16:06

Target

neve.dll
Size

556KB
MD5

9f68d1a4b33e3ace6215040dc9fc73e8
SHA1

cfcbcbefd9967320a60c6890775930a0634f1341
SHA256

d2fc2e2b90b23c2a91e144fd8ac22668dd682f7d0145963615203d087c48aca4
SHA512

5b86c512d894e81c4f9533f3c9e642288256c9fbeaa175b2f3a78409616207c132898cf243bc9f55dc3f6db80e39e666373d301b6539bf2ab31353474f5b53c4
SSDEEP

12288:Nxz8UNfabvFrNIOSUBneHnYvbXb1teVcrS+guzo2I:N2io3IOSgeW7f0cW+gST

Score

10^/10

Family

gozi

Botnet

202206061

https://gigimas.xyz

https://reaso.xyz

Attributes

aes.plain

Family

gozi

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

2 1032 rundll32.exe
4 1032 rundll32.exe
5 1032 rundll32.exe
6 1032 rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 1760	1032	rundll32.exe	cmd.exe
PID 1032 wrote to memory of 1760	1032	rundll32.exe	cmd.exe
PID 1032 wrote to memory of 1760	1032	rundll32.exe	cmd.exe
PID 1032 wrote to memory of 1760	1032	rundll32.exe	cmd.exe
PID 1032 wrote to memory of 1552	1032	rundll32.exe	cmd.exe
PID 1032 wrote to memory of 1552	1032	rundll32.exe	cmd.exe
PID 1032 wrote to memory of 1552	1032	rundll32.exe	cmd.exe
PID 1032 wrote to memory of 1552	1032	rundll32.exe	cmd.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\neve.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\cmd.exe
cmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\7C50.tmp
3⤵
PID:1760

C:\Windows\SysWOW64\cmd.exe
cmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\7C50.tmp
3⤵
PID:1552

C:\Users\Admin\AppData\Local\Temp\7C50.tmp
Filesize
11B

MD5
a67f2061c697fd95f6b28d89b953a51f

SHA1
6730b864104f0840fcebf04383d2e3ef7c324a48

SHA256
d4bdd82a900fea52cbd442ce8cae201982392d3533d765bfceb7682bc2d16a79

SHA512
d9cc7c1593967dbcaf358bc9d394426d97baa7bb6ddeed1767b638c85aa814276eaa3609588b720cab3b2a0b3e36d1d3833dab3e75c9c1a92b8315db61a64cbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7C50.tmp
Filesize
3KB

MD5
aae6e9f5f4de5ecfaf75d108995b244b

SHA1
c998d92034db89a8321489ad50563172503ee2ac

SHA256
f3da5b4634a3214657781d3c4f3bcd43bf4fbddc5013af913cbbbc5bb73713dc

SHA512
09b73de790c334a2a99062bf6525df410bd8917427097bc776ca501222b2faec4d06c2a382df276470623c62e39cf5f56596d52df9135f19217a1813b5faa3a4

Download Submit
memory/1032-54-0x0000000000000000-mapping.dmp

Download
memory/1032-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1032-56-0x00000000001B0000-0x000000000023F000-memory.dmp

Filesize
572KB

Download
memory/1032-57-0x0000000000450000-0x000000000045F000-memory.dmp

Filesize
60KB

Download
memory/1032-58-0x0000000000450000-0x000000000045F000-memory.dmp

Filesize
60KB

Download
memory/1032-59-0x0000000000320000-0x0000000000335000-memory.dmp

Filesize
84KB

Download
memory/1032-60-0x0000000000450000-0x000000000045F000-memory.dmp

Filesize
60KB

Download
memory/1552-62-0x0000000000000000-mapping.dmp

Download
memory/1760-61-0x0000000000000000-mapping.dmp

Download