gozi | e1eccd1c27d390a9b08fe3314e450b97348d36fccf0cdada901edf9270a503bd

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2024 05:50

Target

9f9830791b377db452e376b1f5b7a609.dll
Size

643KB
MD5

9f9830791b377db452e376b1f5b7a609
SHA1

4a7bb8bf507fbcd55aad260b9de7aad24a8ce83a
SHA256

e1eccd1c27d390a9b08fe3314e450b97348d36fccf0cdada901edf9270a503bd
SHA512

10a948089c3a6989db5c62091f76309e3c7b8ad884cd09fa5c914ae7ac5981831e618d2ee9d5d412f8ef79616d60e03f13250d074f713d21f50a3db4e74b5b7c
SSDEEP

12288:HMUpikM1ABVY4lsBnllWzwazxRvwZ9QKC71L715+PoR5nFIlW2i:K4Y4lglQzwyxRvw/SJLT5FIV

Score

10^/10

Family

gozi

Family

gozi

Botnet

1500

gtr.antoinfer.com

app.bighomegl.at

Attributes

rsa_pubkey.plain

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3640 wrote to memory of 3080	3640	rundll32.exe	rundll32.exe
PID 3640 wrote to memory of 3080	3640	rundll32.exe	rundll32.exe
PID 3640 wrote to memory of 3080	3640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f9830791b377db452e376b1f5b7a609.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f9830791b377db452e376b1f5b7a609.dll,#1
2⤵
PID:3080

memory/3080-0-0x0000000075790000-0x0000000075843000-memory.dmp

Filesize
716KB

Download
memory/3080-1-0x0000000001230000-0x0000000001231000-memory.dmp

Filesize
4KB

Download
memory/3080-2-0x0000000075790000-0x0000000075843000-memory.dmp

Filesize
716KB

Download
memory/3080-3-0x0000000075790000-0x0000000075843000-memory.dmp

Filesize
716KB

Download
memory/3080-4-0x0000000001300000-0x000000000130D000-memory.dmp

Filesize
52KB

Download
memory/3080-7-0x0000000075790000-0x0000000075843000-memory.dmp

Filesize
716KB

Download