gozi | 0b0a251719cc3c7f1a7cc1ce8b62f7b40b7747af08bcb9dc3ce95ccc94bd78b7

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
826e3f4fa6ac406d4143c9031704d1f1ae474740c59769deaf7c3bd0886f7828.dll
Size 496KB
Sample230901-sa8rysff29
SHA256 826e3f4fa6ac406d4143c9031704d1f1ae474740c59769deaf7c3bd0886f7828
MD5 20be9f99443471337677b822d64f3597
SHA1 cc60eb639199b675faadfa858d4b4d5fbe40620f
SHA512 73c9fa7da507cb561c264aadf8a2767472b8f80d453c1bef023dffd640be5a50494befe3d53de7fee40b03116c041ace074edfe1326749bd6b4f96f593f93123
SSDEEP 6144:v1IBXjS6D3sj/6L+Roit85Ckwmu+rPJJpevpNsN3nqblYXMg:udnD8D0+R32wP+rpcNEqb1g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi 5050 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

config.edge.skype.com
meganetwork.top
supernetwork.top
internetcoca.in
31.207.46.124
139.60.163.161
dendexmm.com

Attributes

base_path
/jerry/
build
250249
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2188	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2188	1992	rundll32.exe	78
PID 1992 wrote to memory of 2188	1992	rundll32.exe	78
PID 1992 wrote to memory of 2188	1992	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\826e3f4fa6ac406d4143c9031704d1f1ae474740c59769deaf7c3bd0886f7828.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\826e3f4fa6ac406d4143c9031704d1f1ae474740c59769deaf7c3bd0886f7828.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-0-0x00000000010C0000-0x00000000010C6000-memory.dmp

Download

memory/2188-1-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2188-2-0x0000000002B70000-0x0000000002B7D000-memory.dmp

Download

memory/2188-5-0x0000000000400000-0x000000000047E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads