gozi | 1be687a0453f23ea53b94a4447c926a9b4b6e01c2788e641b76eb4a5215bd960

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2024 18:23

Target

5aa733e108f0fa41df88cea0a309affe_JaffaCakes118.dll
Size

701KB
MD5

5aa733e108f0fa41df88cea0a309affe
SHA1

ce79918ca7845f2163360ea40a251912998ea226
SHA256

1be687a0453f23ea53b94a4447c926a9b4b6e01c2788e641b76eb4a5215bd960
SHA512

e18ef98a6bb007ee0ef473cd05bad85ac2f177d316981658e17a12f182effbcc98754fbefc362a4212a8eebcc71fc2e2a15c865b08c50f5990223bcb55d001af
SSDEEP

12288:VUAQSxn6fDEr8Np6b/rPPsjosrS9aEoe+0JCym+4YJAOSVUNcuHIGF4uW/XrGAsR:Vz3xn6fq8Np6bTPPaBreaZlYCOSVol2u

Score

10^/10

Family

gozi

Family

gozi

Botnet

8899

msn.com/mail

breuranel.website

outlook.com/signup

areuranel.website

Attributes

rsa_pubkey.plain

serpent.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

22 5012 rundll32.exe
24 5012 rundll32.exe
44 5012 rundll32.exe
46 5012 rundll32.exe
55 5012 rundll32.exe
57 5012 rundll32.exe
59 5012 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4184 wrote to memory of 5012	4184	rundll32.exe	rundll32.exe
PID 4184 wrote to memory of 5012	4184	rundll32.exe	rundll32.exe
PID 4184 wrote to memory of 5012	4184	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa733e108f0fa41df88cea0a309affe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4184

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa733e108f0fa41df88cea0a309affe_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
PID:5012

memory/5012-0-0x0000000074E50000-0x0000000074F9C000-memory.dmp

Filesize
1.3MB

Download
memory/5012-2-0x0000000074E50000-0x0000000074F9C000-memory.dmp

Filesize
1.3MB

Download
memory/5012-3-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/5012-1-0x0000000074E50000-0x0000000074F9C000-memory.dmp

Filesize
1.3MB

Download
memory/5012-4-0x0000000002410000-0x0000000002420000-memory.dmp

Filesize
64KB

Download
memory/5012-7-0x0000000074E50000-0x0000000074F9C000-memory.dmp

Filesize
1.3MB

Download
memory/5012-9-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download