gozi | 6589003cf1942258e49562dbec1dec0eae7474d423e757a675004bd900cd79a0

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 07:28

Target

2d64f3a3099cf3803a2af68f0b784ec7.dll
Size

461KB
MD5

2d64f3a3099cf3803a2af68f0b784ec7
SHA1

ca7046ebe78496d1be9884ce9bd36abd05284af1
SHA256

6589003cf1942258e49562dbec1dec0eae7474d423e757a675004bd900cd79a0
SHA512

b881184c93b80734444e2e74abcaff144c368a701d5ccf7014098ac6b2febfddfc70322f5728bc9c0f5d5a3b6d631c4543b71b8bcb9fe816aa7840fe85e20433
SSDEEP

12288:mxIkdQI90tC1o4ivB/QD3Jv58kEPGxU3aV+2d:5pI90k3ivB/Q1mZ73a42

Score

10^/10

Family

gozi

Family

gozi

Botnet

1500

gtr.antoinfer.com

app.bighomegl.at

Attributes

rsa_pubkey.plain

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4260 wrote to memory of 2300	4260	rundll32.exe	rundll32.exe
PID 4260 wrote to memory of 2300	4260	rundll32.exe	rundll32.exe
PID 4260 wrote to memory of 2300	4260	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d64f3a3099cf3803a2af68f0b784ec7.dll,#1
1⤵
PID:2300

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d64f3a3099cf3803a2af68f0b784ec7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4260

memory/2300-1-0x0000000074F40000-0x0000000075052000-memory.dmp

Filesize
1.1MB

Download
memory/2300-2-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2300-0-0x0000000074F40000-0x0000000075052000-memory.dmp

Filesize
1.1MB

Download
memory/2300-3-0x0000000002F40000-0x0000000002F4D000-memory.dmp

Filesize
52KB

Download
memory/2300-6-0x0000000074F40000-0x0000000075052000-memory.dmp

Filesize
1.1MB

Download