gozi | 60591e0599585333cb8013f02b808e18dc7c4b529bad9ed8073302a14c0179a0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 18:32

Target

ebb94346f19c906fd5da7bef1e85950d_JaffaCakes118.dll
Size

643KB
MD5

ebb94346f19c906fd5da7bef1e85950d
SHA1

7da634b0050cc24fd9cb60ac12303ea2279dbe8b
SHA256

60591e0599585333cb8013f02b808e18dc7c4b529bad9ed8073302a14c0179a0
SHA512

d2d0181f12cde858138894119ffd67efab4e5c67d60c3ce8c52123cf78ee31bdc93a8bc89cf06ee5b7e05d9f31f9f5e798c524a2b6213002a095f8e0ca65d731
SSDEEP

12288:HMUpikM1ABVY4lsBnllWzwazxRvwN9QKC71L715+PoR5nFIlW2i:K4Y4lglQzwyxRvwDSJLT5FIV

Score

10^/10

Family

gozi

Family

gozi

Botnet

1500

gtr.antoinfer.com

app.bighomegl.at

Attributes

rsa_pubkey.plain

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4196 wrote to memory of 4404	4196	rundll32.exe	rundll32.exe
PID 4196 wrote to memory of 4404	4196	rundll32.exe	rundll32.exe
PID 4196 wrote to memory of 4404	4196	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebb94346f19c906fd5da7bef1e85950d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4196

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebb94346f19c906fd5da7bef1e85950d_JaffaCakes118.dll,#1
2⤵
PID:4404

memory/4404-0-0x0000000075780000-0x0000000075833000-memory.dmp

Filesize
716KB

Download
memory/4404-1-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/4404-2-0x0000000000820000-0x000000000082D000-memory.dmp

Filesize
52KB

Download
memory/4404-5-0x0000000075780000-0x0000000075833000-memory.dmp

Filesize
716KB

Download