gozi | 2230e68172e67d6e672b4bed35664fbbd949d188fef89a1c4204acaa6cb8c45c

Analysis

max time kernel
70s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/12/2022, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
exodus-windows-x64-22.12.5.exe
Size 97KB
Sample221227-sy76bsfa93
SHA256 2230e68172e67d6e672b4bed35664fbbd949d188fef89a1c4204acaa6cb8c45c
MD5 a02e059be6d4e57b9b2b09cb858f3cd5
SHA1 aaf48bec0e0b8c370c4bcf575c4819c963339c82
SHA512 d4db47f513498c29c2633b49b405c3c729fc87461727f45791fbc8dee4e7df70dcb014537ef489f20273451980b6fd37ac85f5e3e883f8ba6dc11b97b302e8f1
SSDEEP 1536:mhmVDzfKwCQX8J1ihBXnN/wHR/ai9RtCUtodAWWEXADXb4D11Fe9HiHRzdP:24fKWBXN/gztnCwSnWHMxdP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi 201122 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

201122

telemetry.skype.com
slakosuoyoliusdd.ru
ssosnulaoyobermanoba4.ru
gdosxuincaluiprada8.ru
meskon4ilaoyoosd.ru
klspotuvlico93hhu8.ru
chespnagybioynedr.ru

Attributes

base_path
/drew/,/images/
build
250249
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4540 set thread context of 3988	4540	exodus-windows-x64-22.12.5.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	3988	WerFault.exe	81

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 3988	4540	exodus-windows-x64-22.12.5.exe	81
PID 4540 wrote to memory of 3988	4540	exodus-windows-x64-22.12.5.exe	81
PID 4540 wrote to memory of 3988	4540	exodus-windows-x64-22.12.5.exe	81
PID 4540 wrote to memory of 3988	4540	exodus-windows-x64-22.12.5.exe	81
PID 4540 wrote to memory of 3988	4540	exodus-windows-x64-22.12.5.exe	81
PID 4540 wrote to memory of 3988	4540	exodus-windows-x64-22.12.5.exe	81
PID 4540 wrote to memory of 3988	4540	exodus-windows-x64-22.12.5.exe	81
PID 4540 wrote to memory of 3988	4540	exodus-windows-x64-22.12.5.exe	81
PID 4540 wrote to memory of 3988	4540	exodus-windows-x64-22.12.5.exe	81
PID 4540 wrote to memory of 3988	4540	exodus-windows-x64-22.12.5.exe	81
PID 4540 wrote to memory of 3988	4540	exodus-windows-x64-22.12.5.exe	81

C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.12.5.exe
"C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.12.5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.12.5.exe
  "C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.12.5.exe"
  2⤵
  PID:3988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 212
    3⤵
    - Program crash
    PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3988 -ip 3988
1⤵
PID:4356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3988-137-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download

memory/3988-141-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download

memory/3988-145-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download

memory/4540-132-0x0000000000510000-0x000000000052E000-memory.dmp

Download

memory/4540-133-0x0000000005500000-0x0000000005AA4000-memory.dmp

Download

memory/4540-134-0x0000000004EC0000-0x0000000004F26000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads