gozi | 19203b83235f7a82df72c041702c8c74934452aba6b5cd340881369a738b40ad

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

679931671e9946dec7f100a76aa0c32d_JaffaCakes118.dll
Size

1.2MB
MD5

679931671e9946dec7f100a76aa0c32d
SHA1

79886619c2d123b3fa8be0ce8a2472f628886307
SHA256

19203b83235f7a82df72c041702c8c74934452aba6b5cd340881369a738b40ad
SHA512

fa318517c1d12d08370c849599eb108f4bf37c938b45e9d0542bd087c4d52c1034355cc018603d20ef6facd830eed79e82a59c5b566ec341f7f77e1fd7ee58b2
SSDEEP

24576:EQWt7MQhrgc/IQA3DEEf3cFDZYbZy8zl2ws5KHGv/ChfHOtpfdwuPiHT8XYAT/a8:xuHrgc/IQA3oEvcFtYbZy8zl2wLHGv/1

Score

10^/10

gozi 8899 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

8899

msn.com/login

vloderuniok.website

gloderuniok.website

Attributes

base_path
/jkloio/
build
260212
dga_season
10
exe_type
loader
extension
.lko
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2364 wrote to memory of 2184	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2184	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2184	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2184	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2184	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2184	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2184	2364	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\679931671e9946dec7f100a76aa0c32d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\679931671e9946dec7f100a76aa0c32d_JaffaCakes118.dll,#1
2⤵
PID:2184

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x0000000072CE0000-0x0000000073717000-memory.dmp

Filesize
10.2MB

Download
memory/2184-1-0x0000000072CE0000-0x0000000073717000-memory.dmp

Filesize
10.2MB

Download
memory/2184-2-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2184-3-0x0000000072CE0000-0x0000000073717000-memory.dmp

Filesize
10.2MB

Download
memory/2184-4-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/2184-7-0x0000000072CE0000-0x0000000073717000-memory.dmp

Filesize
10.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads