gozi | 5b3ec035417ce4250972b82c5b2006ae462c7270f7a810e321808fb1640bac78

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2024 12:21

Target

5fe027b959d9bd3b2326fad006c63662.dll
Size

520KB
MD5

5fe027b959d9bd3b2326fad006c63662
SHA1

96b1b4db049fb68a3aa3879aa64045d2411435dd
SHA256

5b3ec035417ce4250972b82c5b2006ae462c7270f7a810e321808fb1640bac78
SHA512

4db8141bfe71450278edc0f4af3fd6da7dd47d24f1f228adb2cd3f2e53752690ccd69e37686f81cd39e398b69c1447d9dfac1ec02f4d7b516d23f82789773288
SSDEEP

12288:0/1dF5oiiOpCp1wwMnJELHD/4M1kPD7KrY4Zk1Af0fSlllll/lllllj1OrvhcGX:0/h5aOwIqHcR7P4m1AESlllll/lllll0

Score

10^/10

Family

gozi

Family

gozi

Botnet

1500

gtr.antoinfer.com

app.bighomegl.at

Attributes

rsa_pubkey.plain

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2964 wrote to memory of 388	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 388	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 388	2964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fe027b959d9bd3b2326fad006c63662.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fe027b959d9bd3b2326fad006c63662.dll,#1
2⤵
PID:388

memory/388-0-0x0000000010000000-0x0000000010116000-memory.dmp

Filesize
1.1MB

Download
memory/388-1-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/388-2-0x0000000010000000-0x0000000010116000-memory.dmp

Filesize
1.1MB

Download
memory/388-3-0x0000000010000000-0x0000000010116000-memory.dmp

Filesize
1.1MB

Download
memory/388-4-0x0000000001150000-0x000000000115D000-memory.dmp

Filesize
52KB

Download
memory/388-7-0x0000000010000000-0x0000000010116000-memory.dmp

Filesize
1.1MB

Download
memory/388-9-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download