gozi | 9314c01984c89151f6d4624acad638fe054b3036fcc5115271cb598954c20070

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 13:09

Target

ae97252af977c7e64b2eeca6140e129e.dll
Size

543KB
MD5

ae97252af977c7e64b2eeca6140e129e
SHA1

269f90889d519741b79e52ea427fbc37e6a01868
SHA256

9314c01984c89151f6d4624acad638fe054b3036fcc5115271cb598954c20070
SHA512

07fb03be2fbb630d17b832550b774d1f416db84b7dfe05c552ee79a752892b567f49989a1f2dd4b3e6f12cffd55ab312ae76511e841fb22c9e31eba109e8a1c5
SSDEEP

12288:KaME5j1f/QOwOSnV8Eh3doxeNZNN2lFzx3ycxXs4:Kafz3E4INX03ycxc4

Score

10^/10

Family

gozi

Family

gozi

Botnet

8877

outlook.com

zaluoa.live

daskdjknefjkewfnkjwe.net

Attributes

rsa_pubkey.plain

serpent.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2448 wrote to memory of 3076	2448	rundll32.exe	rundll32.exe
PID 2448 wrote to memory of 3076	2448	rundll32.exe	rundll32.exe
PID 2448 wrote to memory of 3076	2448	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae97252af977c7e64b2eeca6140e129e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae97252af977c7e64b2eeca6140e129e.dll,#1
2⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3144 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:3036

memory/3076-0-0x0000000074C10000-0x0000000074D34000-memory.dmp

Filesize
1.1MB

Download
memory/3076-1-0x0000000074C10000-0x0000000074D34000-memory.dmp

Filesize
1.1MB

Download
memory/3076-2-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/3076-3-0x0000000074C10000-0x0000000074D34000-memory.dmp

Filesize
1.1MB

Download
memory/3076-4-0x0000000074C10000-0x0000000074D34000-memory.dmp

Filesize
1.1MB

Download
memory/3076-6-0x0000000074C10000-0x0000000074D34000-memory.dmp

Filesize
1.1MB

Download
memory/3076-7-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/3076-8-0x0000000074C10000-0x0000000074D34000-memory.dmp

Filesize
1.1MB

Download
memory/3076-12-0x0000000074C10000-0x0000000074D34000-memory.dmp

Filesize
1.1MB

Download