gozi | 325f7b8b082c01f0b950f001c0bef4d0fc3bb5cef1a8a74bc9dc60be3bdc32e7

Analysis

max time kernel
150s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29/03/2023, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6424024a060bf.tiff.dll
Size 613KB
Sample230329-k96smsff67
SHA256 325f7b8b082c01f0b950f001c0bef4d0fc3bb5cef1a8a74bc9dc60be3bdc32e7
MD5 ae85c25efdd62bed6e2c3ed12a22a217
SHA1 07ce0da778545abed3755151950c068299decfa7
SHA512 609c667c364285856e265a1cab629b482f9dd0ad91c1a0cfd39e29dbda2158228f21fbc7c33bc9fcd10268b75fd858aed31b6d9ecbcee48ba19f240c56644920
SSDEEP 12288:T0UQoMETWK5TpM7vBzCpgbiH4tDjwRQm3WG5Tms:ZQoMETWK5Te79CpgbiH4xjwRBW5s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi 5050 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

https://config.edge.skype.com
91.215.85.186

Attributes

base_path
/jerry/
build
250255
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1344	1708	regsvr32.exe	28
PID 1708 wrote to memory of 1344	1708	regsvr32.exe	28
PID 1708 wrote to memory of 1344	1708	regsvr32.exe	28
PID 1708 wrote to memory of 1344	1708	regsvr32.exe	28
PID 1708 wrote to memory of 1344	1708	regsvr32.exe	28
PID 1708 wrote to memory of 1344	1708	regsvr32.exe	28
PID 1708 wrote to memory of 1344	1708	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6424024a060bf.tiff.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6424024a060bf.tiff.dll
  2⤵
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-54-0x0000000010000000-0x000000001000F000-memory.dmp

Download

memory/1344-58-0x0000000000200000-0x000000000020E000-memory.dmp

Download

memory/1344-63-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1344-64-0x0000000070300000-0x00000000703A1000-memory.dmp

Download

memory/1344-65-0x0000000000230000-0x000000000023D000-memory.dmp

Download

memory/1344-78-0x0000000070300000-0x00000000703A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads