gozi | b601a3c9c3a3df9043ea82733f1da5b413207d7585ca6b18baa8a4d923ce92d8

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 15:29

Target

903cf677ba834a968b42bd71e4626a9d_JaffaCakes118.dll
Size

701KB
MD5

903cf677ba834a968b42bd71e4626a9d
SHA1

c751f3ab4612917d15967fc1f0591e674c2e56ca
SHA256

b601a3c9c3a3df9043ea82733f1da5b413207d7585ca6b18baa8a4d923ce92d8
SHA512

b81d6b419c05ac351d086ab9d439b7cf2d8db21208f85b13e483bacb800a811890ca7fc3ce2295d2861f3323b0d52725e27f42758ef4ec6312018b4a7a249095
SSDEEP

12288:1UAQSx16fDEr8Np6b/rPPsjosrS9aEoe+0JCym+4YJAOSVUNcuHIGF4uW/XrGAsF:1z3x16fq8Np6bTPPaBreaZlYCOSVol2S

Score

10^/10

Family

gozi

Family

gozi

Botnet

8899

msn.com/mail

breuranel.website

outlook.com/signup

areuranel.website

Attributes

rsa_pubkey.plain

serpent.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

36 2112 rundll32.exe
38 2112 rundll32.exe
46 2112 rundll32.exe
48 2112 rundll32.exe
54 2112 rundll32.exe
55 2112 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1664 wrote to memory of 2112	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 2112	1664	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 2112	1664	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\903cf677ba834a968b42bd71e4626a9d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\903cf677ba834a968b42bd71e4626a9d_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5396 --field-trial-handle=2240,i,16875000905773190493,11379096115878622792,262144 --variations-seed-version /prefetch:8
1⤵
PID:4476

memory/2112-0-0x0000000075520000-0x000000007566C000-memory.dmp

Filesize
1.3MB

Download
memory/2112-2-0x0000000075520000-0x000000007566C000-memory.dmp

Filesize
1.3MB

Download
memory/2112-3-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/2112-1-0x0000000075520000-0x000000007566C000-memory.dmp

Filesize
1.3MB

Download
memory/2112-4-0x0000000000F70000-0x0000000000F80000-memory.dmp

Filesize
64KB

Download
memory/2112-7-0x0000000075520000-0x000000007566C000-memory.dmp

Filesize
1.3MB

Download
memory/2112-9-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download