gozi | b7118f6cd74d92c5fd06cb11931c161d031e6bd0cfe121b91e831bf1d5ca64c7

Analysis

max time kernel
119s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 09:34

Target

a1882445b6e89bf1112354e22f3062c0.exe
Size

2.7MB
MD5

a1882445b6e89bf1112354e22f3062c0
SHA1

1c6cf8a64b32e255ba0616eb61967be0bf55f88f
SHA256

b7118f6cd74d92c5fd06cb11931c161d031e6bd0cfe121b91e831bf1d5ca64c7
SHA512

0562e8d8982bab35f3a5a46e509863622edd4d6dc11715e6c67b29f4bcc28f5ece7a88fde57ba4e851260634060369a43834ef6af3af2b3e8f6fa2139d93e9a0
SSDEEP

49152:C99FYePL9j9qwVoTD0Cn8AzTIPqkqIreD0nn7CZQdI5+SRVUMU3OJR/:C1j/ikC8AH1sewn2+SjLaOJR

Score

10^/10

Family

gozi

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Deletes itself 1 IoCs

Processes:

a1882445b6e89bf1112354e22f3062c0.exe

pid process

2088 a1882445b6e89bf1112354e22f3062c0.exe
Executes dropped EXE 1 IoCs

Processes:

a1882445b6e89bf1112354e22f3062c0.exe

pid process

2088 a1882445b6e89bf1112354e22f3062c0.exe
Loads dropped DLL 1 IoCs

Processes:

a1882445b6e89bf1112354e22f3062c0.exe

pid process

2744 a1882445b6e89bf1112354e22f3062c0.exe

pid	process
2088	a1882445b6e89bf1112354e22f3062c0.exe

pid	process
2088	a1882445b6e89bf1112354e22f3062c0.exe

pid	process
2744	a1882445b6e89bf1112354e22f3062c0.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2744-2-0x0000000000400000-0x000000000086A000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exe	upx
behavioral1/memory/2088-17-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/memory/2744-15-0x0000000003690000-0x0000000003AFA000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

a1882445b6e89bf1112354e22f3062c0.exe

pid process

2744 a1882445b6e89bf1112354e22f3062c0.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

a1882445b6e89bf1112354e22f3062c0.exea1882445b6e89bf1112354e22f3062c0.exe

pid process

2744 a1882445b6e89bf1112354e22f3062c0.exe
2088 a1882445b6e89bf1112354e22f3062c0.exe

pid	process
2744	a1882445b6e89bf1112354e22f3062c0.exe

pid	process
2744	a1882445b6e89bf1112354e22f3062c0.exe
2088	a1882445b6e89bf1112354e22f3062c0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a1882445b6e89bf1112354e22f3062c0.exe

description	pid	process	target process
PID 2744 wrote to memory of 2088	2744	a1882445b6e89bf1112354e22f3062c0.exe	a1882445b6e89bf1112354e22f3062c0.exe
PID 2744 wrote to memory of 2088	2744	a1882445b6e89bf1112354e22f3062c0.exe	a1882445b6e89bf1112354e22f3062c0.exe
PID 2744 wrote to memory of 2088	2744	a1882445b6e89bf1112354e22f3062c0.exe	a1882445b6e89bf1112354e22f3062c0.exe
PID 2744 wrote to memory of 2088	2744	a1882445b6e89bf1112354e22f3062c0.exe	a1882445b6e89bf1112354e22f3062c0.exe

\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exe
Filesize
2.7MB

MD5
bf6622176235ca27076c756ebc97e90a

SHA1
5e927646dc7d7e99969fd284a7166218dc0970f1

SHA256
302527c042daf155629d2bef9d3681ebb74d2446d8cf9f02e5d14c34427a598c

SHA512
8f880206ab5243d674cb82c2d2225303e53b0843ffee4d32b046ea7549bfe425098fb836346168ad46c1cdf2e2aa511973febe74fc36b7f553914acc1e524294

Download Submit
memory/2088-17-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2088-18-0x0000000000130000-0x0000000000242000-memory.dmp

Filesize
1.1MB

Download
memory/2088-19-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2088-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2744-0-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2744-2-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2744-4-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/2744-15-0x0000000003690000-0x0000000003AFA000-memory.dmp

Filesize
4.4MB

Download
memory/2744-14-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2744-26-0x0000000003690000-0x0000000003AFA000-memory.dmp

Filesize
4.4MB

Download