gozi | 54aa0629030dd73c87c439e09e0dda942775da54b61ffde9844ca2bd2cfb07a7

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/12/2022, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
staunch/fizzy.dll
Size 580KB
Sample221215-vs55wsfh2s
SHA256 7ad0db9da1c28e6d12826b846ee3c82bda649e00d717cb2c4aefeaed56ea48ce
MD5 7272aaeea39e988faaf3a5aebc6c7867
SHA1 d3b4222a0a7a1b5271bbc0d016020c6a73850f68
SHA512 f7bab09517e57449d9b17887d34c2420ddf1699dee9dd991650090edb14016a9416c6f2e7e6a713499721525bc6a0871206b6f18b98ca40324ca7d64860a1014
SSDEEP 12288:oqH1vzAJ8RyddM/ZZwp7ZhOwJxfgOBtP/Wl:fboPdMzwtZhzBgOrW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi 50000 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

50000

http://confisg.edges.skype.com
http://108.61.165.145
http://37.120.222.23
http://194.76.224.234
http://176.10.111.47

Attributes

base_path
/grome/
build
250249
exe_type
loader
extension
.chk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\staunch\fizzy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\staunch\fizzy.dll,#1
  2⤵
  PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Download

memory/1176-56-0x0000000000840000-0x00000000008D4000-memory.dmp

Download

memory/1176-58-0x0000000000840000-0x00000000008D4000-memory.dmp

Download

memory/1176-60-0x00000000000B0000-0x00000000000B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads