gozi | 5cc3089e6115e50b2b1182b5789124c3d8386e7525eab3946984ff79ce47ff23

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-10-2023 12:53

Target

cb652995b061a5269f7e4f51a01c2282108c307fcddd043a0d8ceae29c795cff.dll
Size

241KB
MD5

6a8250fc42834f3ee7923c6fbc419296
SHA1

01a8b47f3690f09665f5624bda8ec733234dd526
SHA256

cb652995b061a5269f7e4f51a01c2282108c307fcddd043a0d8ceae29c795cff
SHA512

67e7b9366d0d6e3754f501f341b820556a3dd2cc4288c1c56ff0b12285104a1d45a534f7af37bdf42ab5d843eab8b68e7fbc7d5b3233d784c6d59cf3791802e8
SSDEEP

6144:hwBleesZTUgRttGQn0yf5tk3Etd9F4veS:sge6aQZ5tLIe

Score

10^/10

Family

gozi

Family

gozi

Botnet

5050

https://config.edge.skype.com

91.215.85.204

Attributes

rsa_pubkey.plain

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 1708	2428	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cb652995b061a5269f7e4f51a01c2282108c307fcddd043a0d8ceae29c795cff.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\cb652995b061a5269f7e4f51a01c2282108c307fcddd043a0d8ceae29c795cff.dll
2⤵
PID:1708

memory/1708-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1708-4-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download
memory/1708-9-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/1708-12-0x0000000070340000-0x0000000070383000-memory.dmp

Filesize
268KB

Download