gozi | f73b0df56a13548f550be8e48e49209979e7d6256b477d6bc5cd1456c1fb5da1

Analysis

max time kernel
142s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 15:31

Target

d8b549e78f60995f845d3440e1fd50a6.dll
Size

701KB
MD5

d8b549e78f60995f845d3440e1fd50a6
SHA1

470e30ffc713396d101949dffeed025e7083919d
SHA256

f73b0df56a13548f550be8e48e49209979e7d6256b477d6bc5cd1456c1fb5da1
SHA512

7b9fe78042fe09cf7c1f13d5eca24d2302b9cd324894f8be0ad2b63278aa76a41ae0917edd4e7e7b0df234756510f8849c5c10d7c2f23c86519cc64b4f110c37
SSDEEP

12288:HUAQSxb6fDEr8Np6b/rPPsjosrS9aEoe+0JCym+4YJAOSVUNcuHIGF4uW/XrGAsB:Hz3xb6fq8Np6bTPPaBreaZlYCOSVol22

Score

10^/10

Family

gozi

Family

gozi

Botnet

8899

msn.com/mail

breuranel.website

outlook.com/signup

areuranel.website

Attributes

rsa_pubkey.plain

serpent.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

3 2144 rundll32.exe
5 2144 rundll32.exe
7 2144 rundll32.exe
10 2144 rundll32.exe
12 2144 rundll32.exe
14 2144 rundll32.exe
15 2144 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1636 wrote to memory of 2144	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 2144	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 2144	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 2144	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 2144	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 2144	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 2144	1636	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8b549e78f60995f845d3440e1fd50a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8b549e78f60995f845d3440e1fd50a6.dll,#1
2⤵
- Blocklisted process makes network request
PID:2144

C:\Users\Admin\AppData\Local\Temp\Cab1B7E.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BCF.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2144-0-0x0000000074380000-0x00000000744CC000-memory.dmp

Filesize
1.3MB

Download
memory/2144-2-0x0000000074380000-0x00000000744CC000-memory.dmp

Filesize
1.3MB

Download
memory/2144-3-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2144-4-0x0000000074380000-0x00000000744CC000-memory.dmp

Filesize
1.3MB

Download
memory/2144-5-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2144-8-0x0000000074380000-0x00000000744CC000-memory.dmp

Filesize
1.3MB

Download