gozi | 9513daf7023bedfe2f83faa319c5f253acb6c77fa3e429b959c7a2f696282652 | Triage

Analysis

max time kernel
182s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:06

Sharing

Report Analysis Logs

General

Target

2b2a23d45098a2e54c35e6cadc156e65.dll
Size

472KB
MD5

2b2a23d45098a2e54c35e6cadc156e65
SHA1

2410e40c2b576e744afff81a7f5c0b1c4ed86adf
SHA256

9513daf7023bedfe2f83faa319c5f253acb6c77fa3e429b959c7a2f696282652
SHA512

87c4fc646c5b383642f09516f873041f5c179a33fd2cc7056a3ad05d88ca7d8db417d05dd6d8a6ffb5fad45def6a082be025e6da71444aa575be494784350365
SSDEEP

12288:l8T8E11FE68XED0XZ9YG8nxuU/vkfzJtCcZU:g11m/X/Zv8B/cbs

Score

10^/10

gozi 3500 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

3500

C2

gtr.antoinfer.com

f1.bablefiler.at

Attributes

build
250211
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2700	2676	rundll32.exe	28
PID 2676 wrote to memory of 2700	2676	rundll32.exe	28
PID 2676 wrote to memory of 2700	2676	rundll32.exe	28
PID 2676 wrote to memory of 2700	2676	rundll32.exe	28
PID 2676 wrote to memory of 2700	2676	rundll32.exe	28
PID 2676 wrote to memory of 2700	2676	rundll32.exe	28
PID 2676 wrote to memory of 2700	2676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b2a23d45098a2e54c35e6cadc156e65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b2a23d45098a2e54c35e6cadc156e65.dll,#1
  2⤵
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-0-0x0000000074EA0000-0x0000000074FAD000-memory.dmp

Filesize
1.1MB

Download
memory/2700-1-0x0000000074EA0000-0x0000000074FAD000-memory.dmp

Filesize
1.1MB

Download
memory/2700-2-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download
memory/2700-5-0x0000000074EA0000-0x0000000074FAD000-memory.dmp

Filesize
1.1MB

Download