gozi | 36ce1abbfd9a4bbc48727a514181bcbd7823271a6aca7709da006b3e60b4d46e

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2832721e3caa506e388c363a42c6afab.dll
Size

527KB
MD5

2832721e3caa506e388c363a42c6afab
SHA1

e6f42bb71c158dd695c62879db3b65a97da07e46
SHA256

36ce1abbfd9a4bbc48727a514181bcbd7823271a6aca7709da006b3e60b4d46e
SHA512

ae5badac254fbde4211a9f9c925e5f00f440f699ccc2aba257c47e7235eb376699ed0e006f889234e62569ef376f09a8e709c28801fe84f6dbdfe8f0779a01d2
SSDEEP

12288:yak5GVZ51sBLbLLSTb8/KU0GSq5XCBMtITE9T8Ddzs:yak5GVGBbLLSTo/K4SsSBzndzs

Score

10^/10

gozi 7410 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

7410

signin.microsoft.com

alliances.bar

allianceline.bar

alliancer.bar

Attributes

base_path
/jdraw/
build
250206
dns_servers
107.174.86.134

107.175.127.22
exe_type
loader
extension
.crw
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2228	2520	regsvr32.exe	15
PID 2520 wrote to memory of 2228	2520	regsvr32.exe	15
PID 2520 wrote to memory of 2228	2520	regsvr32.exe	15
PID 2520 wrote to memory of 2228	2520	regsvr32.exe	15
PID 2520 wrote to memory of 2228	2520	regsvr32.exe	15
PID 2520 wrote to memory of 2228	2520	regsvr32.exe	15
PID 2520 wrote to memory of 2228	2520	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2832721e3caa506e388c363a42c6afab.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2832721e3caa506e388c363a42c6afab.dll
  2⤵
  PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-0-0x0000000010000000-0x00000000100D4000-memory.dmp

Filesize
848KB

Download
memory/2228-1-0x0000000010000000-0x00000000100D4000-memory.dmp

Filesize
848KB

Download
memory/2228-2-0x0000000010000000-0x00000000100D4000-memory.dmp

Filesize
848KB

Download
memory/2228-4-0x0000000010000000-0x00000000100D4000-memory.dmp

Filesize
848KB

Download
memory/2228-5-0x0000000010000000-0x00000000100D4000-memory.dmp

Filesize
848KB

Download
memory/2228-6-0x0000000010000000-0x00000000100D4000-memory.dmp

Filesize
848KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads