gozi | 41e7ade34f9ceeae9387d94067ea55076b16e343e9c04067911f7b80c783bad9

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6f672312f8b60781d987bd5762658ce_JaffaCakes118.dll
Size

461KB
MD5

e6f672312f8b60781d987bd5762658ce
SHA1

a799f054930b368c326b0fe3f2d64fcbcdcdea4d
SHA256

41e7ade34f9ceeae9387d94067ea55076b16e343e9c04067911f7b80c783bad9
SHA512

2849d69176215df140ffa215211ad65c119ad0bfdd4a57863788fb7c2960bfd084fc57838e7e8460a8681085182d1e68976e0ccd07405a95dda685447e0324a0
SSDEEP

12288:mxIkdQI90tC1o4iVB/QD3Jv58kEPGxU3aV+2d:5pI90k3iVB/Q1mZ73a42

Score

10^/10

gozi 1500 banker isfb trojan

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1500

gtr.antoinfer.com

app.bighomegl.at

Attributes

build
250211
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6f672312f8b60781d987bd5762658ce_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6f672312f8b60781d987bd5762658ce_JaffaCakes118.dll,#1
2⤵
PID:2012

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x00000000744D0000-0x00000000745E2000-memory.dmp

Filesize
1.1MB

Download
memory/2012-1-0x00000000744D0000-0x00000000745E2000-memory.dmp

Filesize
1.1MB

Download
memory/2012-2-0x00000000744D0000-0x00000000745E2000-memory.dmp

Filesize
1.1MB

Download
memory/2012-4-0x00000000744D0000-0x00000000745E2000-memory.dmp

Filesize
1.1MB

Download
memory/2012-6-0x00000000744D0000-0x00000000745E2000-memory.dmp

Filesize
1.1MB

Download
memory/2012-7-0x00000000744D0000-0x00000000745E2000-memory.dmp

Filesize
1.1MB

Download
memory/2012-8-0x00000000744D0000-0x00000000745E2000-memory.dmp

Filesize
1.1MB

Download
memory/2012-10-0x00000000744D0000-0x00000000745E2000-memory.dmp

Filesize
1.1MB

Download
memory/2012-11-0x00000000744D0000-0x00000000745E2000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads