gozi | 0ca229d6985267551278509807381230b3351e8c1259d46f87bb3d4cac76176b

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-01-2023 19:39

Target

loader-1.dll
Size

58KB
MD5

8d2860deeca2667cd9d9a490b0fb9312
SHA1

d4ed405e29a8c554903cd2313356755899761ec0
SHA256

0ca229d6985267551278509807381230b3351e8c1259d46f87bb3d4cac76176b
SHA512

0e34109e52b5405ca79fb84c0a271c9b19566c234e26d40f98aacd513c0ffbeac29cf44f9a138e71ff904fcd9d1d306ff4fc9106433f72b18911fb21d2f7428e
SSDEEP

1536:lKMj6u5qwXbuHq4DalAccmRCoU0rhZKLuT:nj9KRaR7jT

Score

10^/10

Family

gozi

Botnet

202208151

https://fingerpin.cyou

https://dodstep.cyou

Attributes

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1612 wrote to memory of 1336	1612	regsvr32.exe	cmd.exe
PID 1612 wrote to memory of 1336	1612	regsvr32.exe	cmd.exe
PID 1612 wrote to memory of 1336	1612	regsvr32.exe	cmd.exe
PID 1612 wrote to memory of 2036	1612	regsvr32.exe	cmd.exe
PID 1612 wrote to memory of 2036	1612	regsvr32.exe	cmd.exe
PID 1612 wrote to memory of 2036	1612	regsvr32.exe	cmd.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\loader-1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\system32\cmd.exe
cmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\8F9C.tmp
2⤵
PID:1336

C:\Windows\system32\cmd.exe
cmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\8F9C.tmp
2⤵
PID:2036

C:\Users\Admin\AppData\Local\Temp\8F9C.tmp
Filesize
173B

MD5
38f0354011bd9aa32330fad9ed1f5b6b

SHA1
13498f4fbe131f96164aee99cc7b366d670131dd

SHA256
ecf200dcceaaf5da831c69591b3379eb0905a60b46583feef3534f26acbfcea7

SHA512
c8247219bb7cca035bf4d452492dbe6fe9380ecbca7e4f016eb43138c0b33efad35a7a5be3f895ba3c88adcb8c9be399ecf54b531acd4b791ade9418b0120465

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F9C.tmp
Filesize
3KB

MD5
f88eaf7c05e6e83358387af29b3e3685

SHA1
5bf127cb4d8eebd186444445f27432cbfa623156

SHA256
2e239542ab59ceeb7b3d8e6b337fb466f1d09c420108fb38c463830a2cca2c05

SHA512
1d7f8f5ae4b4b884f554c483798cf3fb51aaf4cf810f82d71b58b8b45fa61976fd43855a1d3cdccdf270aaeceaeabcc574391c67ec2187e406a98c5f128a16f9

Download Submit
memory/1336-61-0x0000000000000000-mapping.dmp

Download
memory/1612-54-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Filesize
8KB

Download
memory/1612-55-0x0000000180000000-0x0000000180013000-memory.dmp

Filesize
76KB

Download
memory/1612-60-0x0000000140000000-0x0000000140011000-memory.dmp

Filesize
68KB

Download
memory/2036-62-0x0000000000000000-mapping.dmp

Download