gozi | 65f687a5c0e757cd8e296f8b0453b27726e5017502e93dcb8379d59fe9c056a3

Analysis

max time kernel
162s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:43

Target

7078612.dll
Size

496KB
MD5

cba263871219062d981111b00cc131fc
SHA1

50e2c7caf7dd0f826bc6e814bd62fbb39982ceed
SHA256

65f687a5c0e757cd8e296f8b0453b27726e5017502e93dcb8379d59fe9c056a3
SHA512

147ce45b24d541edb048ae1e3b82fbdb72e4f88be6fcad04c16d0eaa761f1c3120fdd49a371bf458556b7e1ee03152d48cd5a77cb6a095a63ae238d5929492d3
SSDEEP

6144:VcmfGth2n/4QpDArdVgncHm3pPXig93bNvKQ7lzLNc0RMkHsBAih:XYwFxAmcHm5vigDvKQBzTM/f

Score

10^/10

Family

gozi

Family

gozi

Botnet

5050

config.edge.skype.com

meganetwork.top

supernetwork.top

internetcoca.in

31.207.46.124

139.60.163.161

dendexmm.com

Attributes

rsa_pubkey.plain

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

59 964 rundll32.exe

flow	pid	process
59	964	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2164 wrote to memory of 964	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 964	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 964	2164	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7078612.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7078612.dll,#1
2⤵
- Blocklisted process makes network request
PID:964

memory/964-132-0x0000000000000000-mapping.dmp

Download
memory/964-133-0x00000000020B0000-0x000000000212F000-memory.dmp

Filesize
508KB

Download
memory/964-135-0x00000000020B0000-0x000000000212F000-memory.dmp

Filesize
508KB

Download
memory/964-136-0x00000000020B1000-0x00000000020C8000-memory.dmp

Filesize
92KB

Download
memory/964-138-0x00000000027D0000-0x00000000027DD000-memory.dmp

Filesize
52KB

Download
memory/964-141-0x00000000008C0000-0x00000000008C6000-memory.dmp

Filesize
24KB

Download