gozi | 6589003cf1942258e49562dbec1dec0eae7474d423e757a675004bd900cd79a0

Analysis

max time kernel
146s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d64f3a3099cf3803a2af68f0b784ec7.dll
Size

461KB
MD5

2d64f3a3099cf3803a2af68f0b784ec7
SHA1

ca7046ebe78496d1be9884ce9bd36abd05284af1
SHA256

6589003cf1942258e49562dbec1dec0eae7474d423e757a675004bd900cd79a0
SHA512

b881184c93b80734444e2e74abcaff144c368a701d5ccf7014098ac6b2febfddfc70322f5728bc9c0f5d5a3b6d631c4543b71b8bcb9fe816aa7840fe85e20433
SSDEEP

12288:mxIkdQI90tC1o4ivB/QD3Jv58kEPGxU3aV+2d:5pI90k3ivB/Q1mZ73a42

Score

10^/10

gozi 1500 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1500

gtr.antoinfer.com

app.bighomegl.at

Attributes

build
250211
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2336 wrote to memory of 2012	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2012	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2012	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2012	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2012	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2012	2336	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2012	2336	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d64f3a3099cf3803a2af68f0b784ec7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d64f3a3099cf3803a2af68f0b784ec7.dll,#1
2⤵
PID:2012

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000074CB0000-0x0000000074DC2000-memory.dmp

Filesize
1.1MB

Download
memory/2012-1-0x0000000074CB0000-0x0000000074DC2000-memory.dmp

Filesize
1.1MB

Download
memory/2012-2-0x0000000074CB0000-0x0000000074DC2000-memory.dmp

Filesize
1.1MB

Download
memory/2012-3-0x0000000000200000-0x000000000020D000-memory.dmp

Filesize
52KB

Download
memory/2012-6-0x0000000074CB0000-0x0000000074DC2000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads