gozi | 65f687a5c0e757cd8e296f8b0453b27726e5017502e93dcb8379d59fe9c056a3

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:43

Target

7078612.dll
Size

496KB
MD5

cba263871219062d981111b00cc131fc
SHA1

50e2c7caf7dd0f826bc6e814bd62fbb39982ceed
SHA256

65f687a5c0e757cd8e296f8b0453b27726e5017502e93dcb8379d59fe9c056a3
SHA512

147ce45b24d541edb048ae1e3b82fbdb72e4f88be6fcad04c16d0eaa761f1c3120fdd49a371bf458556b7e1ee03152d48cd5a77cb6a095a63ae238d5929492d3
SSDEEP

6144:VcmfGth2n/4QpDArdVgncHm3pPXig93bNvKQ7lzLNc0RMkHsBAih:XYwFxAmcHm5vigDvKQBzTM/f

Score

10^/10

Family

gozi

Family

gozi

Botnet

5050

config.edge.skype.com

meganetwork.top

supernetwork.top

internetcoca.in

31.207.46.124

139.60.163.161

dendexmm.com

Attributes

rsa_pubkey.plain

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1228 wrote to memory of 2040	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 2040	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 2040	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 2040	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 2040	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 2040	1228	rundll32.exe	rundll32.exe
PID 1228 wrote to memory of 2040	1228	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7078612.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7078612.dll,#1
2⤵
PID:2040

memory/2040-54-0x0000000000000000-mapping.dmp

Download
memory/2040-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x00000000007B0000-0x000000000082F000-memory.dmp

Filesize
508KB

Download
memory/2040-58-0x00000000007B0000-0x000000000082F000-memory.dmp

Filesize
508KB

Download
memory/2040-60-0x00000000000F0000-0x00000000000F6000-memory.dmp

Filesize
24KB

Download
memory/2040-61-0x00000000002C0000-0x00000000002CD000-memory.dmp

Filesize
52KB

Download