gozi | 19203b83235f7a82df72c041702c8c74934452aba6b5cd340881369a738b40ad

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2024 04:23

Target

679931671e9946dec7f100a76aa0c32d_JaffaCakes118.dll
Size

1.2MB
MD5

679931671e9946dec7f100a76aa0c32d
SHA1

79886619c2d123b3fa8be0ce8a2472f628886307
SHA256

19203b83235f7a82df72c041702c8c74934452aba6b5cd340881369a738b40ad
SHA512

fa318517c1d12d08370c849599eb108f4bf37c938b45e9d0542bd087c4d52c1034355cc018603d20ef6facd830eed79e82a59c5b566ec341f7f77e1fd7ee58b2
SSDEEP

24576:EQWt7MQhrgc/IQA3DEEf3cFDZYbZy8zl2ws5KHGv/ChfHOtpfdwuPiHT8XYAT/a8:xuHrgc/IQA3oEvcFtYbZy8zl2wLHGv/1

Score

10^/10

Family

gozi

Family

gozi

Botnet

8899

msn.com/login

vloderuniok.website

gloderuniok.website

Attributes

rsa_pubkey.plain

serpent.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

41 3292 rundll32.exe
43 3292 rundll32.exe
63 3292 rundll32.exe
64 3292 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1628 wrote to memory of 3292	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 3292	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 3292	1628	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\679931671e9946dec7f100a76aa0c32d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\679931671e9946dec7f100a76aa0c32d_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3588 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:2644

memory/3292-0-0x0000000074E10000-0x0000000075847000-memory.dmp

Filesize
10.2MB

Download
memory/3292-1-0x0000000074E10000-0x0000000075847000-memory.dmp

Filesize
10.2MB

Download
memory/3292-2-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/3292-3-0x0000000074E10000-0x0000000075847000-memory.dmp

Filesize
10.2MB

Download
memory/3292-4-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3292-7-0x0000000074E10000-0x0000000075847000-memory.dmp

Filesize
10.2MB

Download
memory/3292-9-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download