gozi | e1f78084344a8b3118e8de8be1a92f2be364cab663e65a706133f16f27148429

Analysis

max time kernel
104s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2024 15:19

Target

a97c1a835321795116cb3aeabf5113c2.exe
Size

1.3MB
MD5

a97c1a835321795116cb3aeabf5113c2
SHA1

1f1f9ee69ebabd91cfefe717e6e919bbdada4cf2
SHA256

e1f78084344a8b3118e8de8be1a92f2be364cab663e65a706133f16f27148429
SHA512

8f1518a5bdf072495eb23a36d5ef7c95ad6fbf6fec96bb27d2316b4c1b81bfca4aacd7f6634339c9250e2ee5f40167040e6cf8b6cba3714e20506e7748fdbe0d
SSDEEP

24576:ji3fRi8qDfO91LCS69E5DNNl+hJI7jDWFlqJLYQ0+VOV7vG:jMN91ZL5hv+qSvqJHd

Score

10^/10

Family

gozi

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Deletes itself 1 IoCs

Processes:

a97c1a835321795116cb3aeabf5113c2.exe

pid process

3688 a97c1a835321795116cb3aeabf5113c2.exe
Executes dropped EXE 1 IoCs

Processes:

a97c1a835321795116cb3aeabf5113c2.exe

pid process

3688 a97c1a835321795116cb3aeabf5113c2.exe

pid	process
3688	a97c1a835321795116cb3aeabf5113c2.exe

pid	process
3688	a97c1a835321795116cb3aeabf5113c2.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/5032-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\a97c1a835321795116cb3aeabf5113c2.exe	upx
behavioral2/memory/3688-15-0x0000000000400000-0x000000000086A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

a97c1a835321795116cb3aeabf5113c2.exe

pid process

5032 a97c1a835321795116cb3aeabf5113c2.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

a97c1a835321795116cb3aeabf5113c2.exea97c1a835321795116cb3aeabf5113c2.exe

pid process

5032 a97c1a835321795116cb3aeabf5113c2.exe
3688 a97c1a835321795116cb3aeabf5113c2.exe

pid	process
5032	a97c1a835321795116cb3aeabf5113c2.exe

pid	process
5032	a97c1a835321795116cb3aeabf5113c2.exe
3688	a97c1a835321795116cb3aeabf5113c2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a97c1a835321795116cb3aeabf5113c2.exe

description	pid	process	target process
PID 5032 wrote to memory of 3688	5032	a97c1a835321795116cb3aeabf5113c2.exe	a97c1a835321795116cb3aeabf5113c2.exe
PID 5032 wrote to memory of 3688	5032	a97c1a835321795116cb3aeabf5113c2.exe	a97c1a835321795116cb3aeabf5113c2.exe
PID 5032 wrote to memory of 3688	5032	a97c1a835321795116cb3aeabf5113c2.exe	a97c1a835321795116cb3aeabf5113c2.exe

C:\Users\Admin\AppData\Local\Temp\a97c1a835321795116cb3aeabf5113c2.exe
Filesize
1.3MB

MD5
d0c6ccb6a40401692c3a88853ab5aba6

SHA1
0f82bb9125253597e3bdb2b3694e0f757b705944

SHA256
300f3551fdfd5c6983cb48cb257fc6ccc1e7cfa908e8483227fe38e5cd1879d3

SHA512
bd638d9c9883adcf402e18e83c2d56da75f89a618d24266d325ab7fe799488e031f5fe9f83acd5f4c114da113bf3a36c73d8b18fa8ffda7a5fa36b792d5cf156

Download Submit
memory/3688-15-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/3688-14-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/3688-17-0x0000000001D40000-0x0000000001E52000-memory.dmp

Filesize
1.1MB

Download
memory/3688-23-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/5032-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/5032-1-0x0000000001CF0000-0x0000000001E02000-memory.dmp

Filesize
1.1MB

Download
memory/5032-2-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/5032-13-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download