gozi | 69d646441885a01d2203c17d5b38c1772d0f8cb76d0a43d33d143e7a0b13f6f8

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 11:05

Target
stage_2gozi.dll
Size 39KB
Sample230321-m6tp1shh69
SHA256 69d646441885a01d2203c17d5b38c1772d0f8cb76d0a43d33d143e7a0b13f6f8
MD5 4984b442edb1cf12523faec4ad99c4ef
SHA1 5387e3fad9ee5d4e894f9ed8c6867c341f6dab11
SHA512 e0f7a261784c295fe86b6d5ef6ad25666cb32d7b7491212a9f8fce52d7436875221b90bb58964c44c55378e4101f65d0346dfc5df087876ae89a02fedbd887f1
SSDEEP 768:A2SGgWkKlrFv+y5NGQgGoKItuFe666yuwyF8sj1YsFVOZd43HmIt6J:MGtkKlA2oKItuLn3kfsLs9/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

Attributes

rsa_pubkey.plain

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 3320	3804	regsvr32.exe	87
PID 3804 wrote to memory of 3320	3804	regsvr32.exe	87
PID 3804 wrote to memory of 3320	3804	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\stage_2gozi.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\stage_2gozi.dll
  2⤵
  PID:3320

memory/3320-133-0x00000000012F0000-0x00000000012FD000-memory.dmp

Download