gozi | 72a7eecae9760385d16289fd8eb4e6353997042265b9fa23d9f3dd8e0dd732a4

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-it
resource tags

arch:x64arch:x86image:win10v2004-20230703-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
21-08-2023 12:01

Target

894668791d06262dd16740235faa3b1672e2cb5cf171954f29abaca421c09265.dll
Size

585KB
MD5

b565aa423ca4ba6e8c6b208c22e5b056
SHA1

0f661ba97e702021988fa372fde43bd3165f1cfe
SHA256

894668791d06262dd16740235faa3b1672e2cb5cf171954f29abaca421c09265
SHA512

b426343c6e8fa54e892fdbf506f1865d89e134e25ff9552bfe2dea36e791a017380aa5220c1af08922e2619d49731f73889de2e6e2efc155c64f4f6f87d701dd
SSDEEP

6144:2Qs4GPx2zWaTL8pxi5mLgNKz+ODzKaDtdjokutIC54VQQkPBRm2mZOkjnEsWKsGs:Y4sQiMjNa+ODmsWDOWrK1idIGd

Score

10^/10

Family

gozi

Family

gozi

Botnet

5050

https://avas1ta.com/in/login/

itwicenice.com

Attributes

rsa_pubkey.plain

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4876 wrote to memory of 4892	4876	regsvr32.exe	regsvr32.exe
PID 4876 wrote to memory of 4892	4876	regsvr32.exe	regsvr32.exe
PID 4876 wrote to memory of 4892	4876	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\894668791d06262dd16740235faa3b1672e2cb5cf171954f29abaca421c09265.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4876

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\894668791d06262dd16740235faa3b1672e2cb5cf171954f29abaca421c09265.dll
2⤵
PID:4892

memory/4892-133-0x0000000002CC0000-0x0000000002CFF000-memory.dmp

Filesize
252KB

Download
memory/4892-134-0x00000000014F0000-0x00000000014FE000-memory.dmp

Filesize
56KB

Download
memory/4892-135-0x0000000002E10000-0x0000000002E1D000-memory.dmp

Filesize
52KB

Download
memory/4892-138-0x0000000002CC0000-0x0000000002CFF000-memory.dmp

Filesize
252KB

Download
memory/4892-139-0x00000000014F0000-0x00000000014FE000-memory.dmp

Filesize
56KB

Download