gozi | 02ba7ec706193f391ef1e7bd3cdd6a374384aa2cb39f81633a1e7e41948c1f7b

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2023, 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

201752c6d4a98d6dc6a693beade4f30097347d1472147b59bed1a4fd91d817cd.dll
Size

492KB
MD5

83a4b9b0266a30e52d51aef5317067be
SHA1

914f2275fa5c061a0bcb8c2b2f094645bda27575
SHA256

201752c6d4a98d6dc6a693beade4f30097347d1472147b59bed1a4fd91d817cd
SHA512

f9391e5d3ff7cf4242d1513724ecdf863391e5a7c489443392f8964e24ad75e883f65d01e84b372faba43e4923dff9890e6d3764d2b6ded031726ce91fe57a56
SSDEEP

6144:gtkZIOdi1a/nGAHSzssd4BxrobrVvEp5HH6ZUNCVcj9lVMJ:ZIuiA/nry9u8HU8UNGA9lVM

Score

10^/10

gozi 5050 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

config.edge.skype.com

optinetwork.top

interspin.top

dendexmm.com

Attributes

base_path
/jerry/
build
250249
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Blocklisted process makes network request 1 IoCs

flow	pid	Process
28	5072	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 5072	1140	rundll32.exe	83
PID 1140 wrote to memory of 5072	1140	rundll32.exe	83
PID 1140 wrote to memory of 5072	1140	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\201752c6d4a98d6dc6a693beade4f30097347d1472147b59bed1a4fd91d817cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\201752c6d4a98d6dc6a693beade4f30097347d1472147b59bed1a4fd91d817cd.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5072-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5072-1-0x00000000010D0000-0x00000000010D6000-memory.dmp

Filesize
24KB

Download
memory/5072-2-0x0000000002E10000-0x0000000002E1D000-memory.dmp

Filesize
52KB

Download
memory/5072-5-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads