gozi | 41c0934ba1be030dbae45893107f6a2ae5f99c79d7634626263cdf809f7556ee

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 03:05

Target

9e67e68ddbedba865b91b5469ab642ef_JaffaCakes118.dll
Size

701KB
MD5

9e67e68ddbedba865b91b5469ab642ef
SHA1

f2c7b0735343081be06e48616d0fc14235a28744
SHA256

41c0934ba1be030dbae45893107f6a2ae5f99c79d7634626263cdf809f7556ee
SHA512

802d983ca7ca04ae737da69ed5772eece8f408c6c02c8d0c42cfea1c1abf25236b02c35c09d56f3ba6a229b3b71f72fa3d4c6735c8670c76affdbbc139b63d87
SSDEEP

12288:aUAQSxl6fDEr8Np6b/rPPsjosrS9aEoe+0JCym+4YJAOSVUNcuHIGF4uW/XrGAsV:az3xl6fq8Np6bTPPaBreaZlYCOSVol2a

Score

10^/10

Family

gozi

Family

gozi

Botnet

8899

msn.com/mail

breuranel.website

outlook.com/signup

areuranel.website

Attributes

rsa_pubkey.plain

serpent.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

21 788 rundll32.exe
23 788 rundll32.exe
44 788 rundll32.exe
46 788 rundll32.exe
54 788 rundll32.exe
56 788 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3284 wrote to memory of 788	3284	rundll32.exe	rundll32.exe
PID 3284 wrote to memory of 788	3284	rundll32.exe	rundll32.exe
PID 3284 wrote to memory of 788	3284	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e67e68ddbedba865b91b5469ab642ef_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e67e68ddbedba865b91b5469ab642ef_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
PID:788

memory/788-0-0x00000000754F0000-0x000000007563C000-memory.dmp

Filesize
1.3MB

Download
memory/788-1-0x00000000754F0000-0x000000007563C000-memory.dmp

Filesize
1.3MB

Download
memory/788-2-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/788-3-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/788-6-0x00000000754F0000-0x000000007563C000-memory.dmp

Filesize
1.3MB

Download
memory/788-8-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download