gozi | 894668791d06262dd16740235faa3b1672e2cb5cf171954f29abaca421c09265

Analysis

max time kernel
33s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04-07-2023 13:41

Target

b565aa423ca4ba6e8c6b208c2.dll
Size

585KB
MD5

b565aa423ca4ba6e8c6b208c22e5b056
SHA1

0f661ba97e702021988fa372fde43bd3165f1cfe
SHA256

894668791d06262dd16740235faa3b1672e2cb5cf171954f29abaca421c09265
SHA512

b426343c6e8fa54e892fdbf506f1865d89e134e25ff9552bfe2dea36e791a017380aa5220c1af08922e2619d49731f73889de2e6e2efc155c64f4f6f87d701dd
SSDEEP

6144:2Qs4GPx2zWaTL8pxi5mLgNKz+ODzKaDtdjokutIC54VQQkPBRm2mZOkjnEsWKsGs:Y4sQiMjNa+ODmsWDOWrK1idIGd

Score

10^/10

Family

gozi

Family

gozi

Botnet

5050

https://avas1ta.com/in/login/

itwicenice.com

Attributes

rsa_pubkey.plain

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe
PID 3016 wrote to memory of 1460	3016	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b565aa423ca4ba6e8c6b208c2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\b565aa423ca4ba6e8c6b208c2.dll
2⤵
PID:1460

memory/1460-54-0x0000000000170000-0x00000000001AF000-memory.dmp

Filesize
252KB

Download
memory/1460-55-0x00000000001B0000-0x00000000001BE000-memory.dmp

Filesize
56KB

Download
memory/1460-56-0x00000000001B0000-0x00000000001BE000-memory.dmp

Filesize
56KB

Download
memory/1460-57-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download