gozi | 5cc3089e6115e50b2b1182b5789124c3d8386e7525eab3946984ff79ce47ff23

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-10-2023 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb652995b061a5269f7e4f51a01c2282108c307fcddd043a0d8ceae29c795cff.dll
Size

241KB
MD5

6a8250fc42834f3ee7923c6fbc419296
SHA1

01a8b47f3690f09665f5624bda8ec733234dd526
SHA256

cb652995b061a5269f7e4f51a01c2282108c307fcddd043a0d8ceae29c795cff
SHA512

67e7b9366d0d6e3754f501f341b820556a3dd2cc4288c1c56ff0b12285104a1d45a534f7af37bdf42ab5d843eab8b68e7fbc7d5b3233d784c6d59cf3791802e8
SSDEEP

6144:hwBleesZTUgRttGQn0yf5tk3Etd9F4veS:sge6aQZ5tLIe

Score

10^/10

gozi 5050 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

https://config.edge.skype.com

91.215.85.204

Attributes

base_path
/jerry/
build
250255
exe_type
loader
extension
.bob
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cb652995b061a5269f7e4f51a01c2282108c307fcddd043a0d8ceae29c795cff.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\cb652995b061a5269f7e4f51a01c2282108c307fcddd043a0d8ceae29c795cff.dll
2⤵
PID:1708

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1708-4-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download
memory/1708-9-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/1708-12-0x0000000070340000-0x0000000070383000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads