gozi | f73b0df56a13548f550be8e48e49209979e7d6256b477d6bc5cd1456c1fb5da1

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2023 15:31

Target

d8b549e78f60995f845d3440e1fd50a6.dll
Size

701KB
MD5

d8b549e78f60995f845d3440e1fd50a6
SHA1

470e30ffc713396d101949dffeed025e7083919d
SHA256

f73b0df56a13548f550be8e48e49209979e7d6256b477d6bc5cd1456c1fb5da1
SHA512

7b9fe78042fe09cf7c1f13d5eca24d2302b9cd324894f8be0ad2b63278aa76a41ae0917edd4e7e7b0df234756510f8849c5c10d7c2f23c86519cc64b4f110c37
SSDEEP

12288:HUAQSxb6fDEr8Np6b/rPPsjosrS9aEoe+0JCym+4YJAOSVUNcuHIGF4uW/XrGAsB:Hz3xb6fq8Np6bTPPaBreaZlYCOSVol22

Score

10^/10

Family

gozi

Family

gozi

Botnet

8899

msn.com/mail

breuranel.website

outlook.com/signup

areuranel.website

Attributes

rsa_pubkey.plain

serpent.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

51 3792 rundll32.exe
53 3792 rundll32.exe
69 3792 rundll32.exe
71 3792 rundll32.exe
80 3792 rundll32.exe
81 3792 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1168 wrote to memory of 3792	1168	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 3792	1168	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 3792	1168	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8b549e78f60995f845d3440e1fd50a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8b549e78f60995f845d3440e1fd50a6.dll,#1
2⤵
- Blocklisted process makes network request
PID:3792

memory/3792-0-0x0000000074E00000-0x0000000074F4C000-memory.dmp

Filesize
1.3MB

Download
memory/3792-2-0x0000000074E00000-0x0000000074F4C000-memory.dmp

Filesize
1.3MB

Download
memory/3792-1-0x0000000074E00000-0x0000000074F4C000-memory.dmp

Filesize
1.3MB

Download
memory/3792-3-0x0000000001480000-0x0000000001481000-memory.dmp

Filesize
4KB

Download
memory/3792-4-0x00000000015F0000-0x0000000001600000-memory.dmp

Filesize
64KB

Download
memory/3792-7-0x0000000074E00000-0x0000000074F4C000-memory.dmp

Filesize
1.3MB

Download
memory/3792-9-0x0000000001480000-0x0000000001481000-memory.dmp

Filesize
4KB

Download