gozi | 1be687a0453f23ea53b94a4447c926a9b4b6e01c2788e641b76eb4a5215bd960

Analysis

max time kernel
142s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-03-2024 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5aa733e108f0fa41df88cea0a309affe_JaffaCakes118.dll
Size

701KB
MD5

5aa733e108f0fa41df88cea0a309affe
SHA1

ce79918ca7845f2163360ea40a251912998ea226
SHA256

1be687a0453f23ea53b94a4447c926a9b4b6e01c2788e641b76eb4a5215bd960
SHA512

e18ef98a6bb007ee0ef473cd05bad85ac2f177d316981658e17a12f182effbcc98754fbefc362a4212a8eebcc71fc2e2a15c865b08c50f5990223bcb55d001af
SSDEEP

12288:VUAQSxn6fDEr8Np6b/rPPsjosrS9aEoe+0JCym+4YJAOSVUNcuHIGF4uW/XrGAsR:Vz3xn6fq8Np6bTPPaBreaZlYCOSVol2u

Score

10^/10

gozi 8899 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

8899

msn.com/mail

breuranel.website

outlook.com/signup

areuranel.website

Attributes

base_path
/liopolo/
build
260212
dga_season
10
exe_type
loader
extension
.jre
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2020 wrote to memory of 2352	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2352	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2352	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2352	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2352	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2352	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2352	2020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa733e108f0fa41df88cea0a309affe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa733e108f0fa41df88cea0a309affe_JaffaCakes118.dll,#1
2⤵
PID:2352

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-0-0x0000000075180000-0x00000000752CC000-memory.dmp

Filesize
1.3MB

Download
memory/2352-1-0x0000000075180000-0x00000000752CC000-memory.dmp

Filesize
1.3MB

Download
memory/2352-2-0x0000000075180000-0x00000000752CC000-memory.dmp

Filesize
1.3MB

Download
memory/2352-3-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2352-4-0x0000000075180000-0x00000000752CC000-memory.dmp

Filesize
1.3MB

Download
memory/2352-5-0x0000000000160000-0x0000000000170000-memory.dmp

Filesize
64KB

Download
memory/2352-8-0x0000000075180000-0x00000000752CC000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads