gozi | 894668791d06262dd16740235faa3b1672e2cb5cf171954f29abaca421c09265

Analysis

max time kernel
33s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04-07-2023 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b565aa423ca4ba6e8c6b208c2.dll
Size

585KB
MD5

b565aa423ca4ba6e8c6b208c22e5b056
SHA1

0f661ba97e702021988fa372fde43bd3165f1cfe
SHA256

894668791d06262dd16740235faa3b1672e2cb5cf171954f29abaca421c09265
SHA512

b426343c6e8fa54e892fdbf506f1865d89e134e25ff9552bfe2dea36e791a017380aa5220c1af08922e2619d49731f73889de2e6e2efc155c64f4f6f87d701dd
SSDEEP

6144:2Qs4GPx2zWaTL8pxi5mLgNKz+ODzKaDtdjokutIC54VQQkPBRm2mZOkjnEsWKsGs:Y4sQiMjNa+ODmsWDOWrK1idIGd

Score

10^/10

gozi 5050 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

https://avas1ta.com/in/login/

itwicenice.com

Attributes

base_path
/jerry/
build
250259
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b565aa423ca4ba6e8c6b208c2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\b565aa423ca4ba6e8c6b208c2.dll
2⤵
PID:1460

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-54-0x0000000000170000-0x00000000001AF000-memory.dmp

Filesize
252KB

Download
memory/1460-55-0x00000000001B0000-0x00000000001BE000-memory.dmp

Filesize
56KB

Download
memory/1460-56-0x00000000001B0000-0x00000000001BE000-memory.dmp

Filesize
56KB

Download
memory/1460-57-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads