gozi | 51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28-08-2023 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe
Size

487KB
MD5

9867dc7c4d3426f29fe668b4474275f7
SHA1

e6130e7735319ddd5b3d9112a70c5878d9c2f041
SHA256

51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94
SHA512

352ec7c3c5db4f33785f0478270adb78044f9828256c8f82eaf274a7ad698d872d8d17727ce2a43669715bf76f4815eadb5e85ff2edcfad62e5cbcb7c9f13ed5
SSDEEP

6144:zdjkmnzdHALJUif3wgYzhNBXGoAKvxOnbOhUQOahb6Wfdu5g8kR9I:zPzdIeiPwX1NBXGAabO5NgWfScI

Score

10^/10

gozi 6000 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

6000

config.edge.skype.com

onlinetwork.top

linetwork.top

mmmmmm.bar

Attributes

base_path
/drew/
build
250246
exe_type
loader
extension
.jlk
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of SetThreadContext 1 IoCs

Processes:

51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe

description	pid	process	target process
PID 3060 set thread context of 544	3060	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe

pid process

3060 51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe

pid	process
3060	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe

description	pid	process	target process
PID 3060 wrote to memory of 544	3060	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe
PID 3060 wrote to memory of 544	3060	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe
PID 3060 wrote to memory of 544	3060	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe
PID 3060 wrote to memory of 544	3060	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe
PID 3060 wrote to memory of 544	3060	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe	51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe

C:\Users\Admin\AppData\Local\Temp\51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe
"C:\Users\Admin\AppData\Local\Temp\51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3060

C:\Users\Admin\AppData\Local\Temp\51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe
"C:\Users\Admin\AppData\Local\Temp\51d6aa64560113b9a438015a55077f65f2684932894fec023270ec833e0f1b94.exe"
2⤵
PID:544

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-5-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/544-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/544-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/544-9-0x0000000000030000-0x000000000003D000-memory.dmp

Filesize
52KB

Download
memory/544-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3060-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3060-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads