gozi | 07c4de5228d721b6ecd076e4fea4a8f1bc55ecc65e7f76e5aed8da390207db7b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 09:21

Target

fc6e37e0aed3ddf819bc3db52c3894d0_JaffaCakes118.dll
Size

476KB
MD5

fc6e37e0aed3ddf819bc3db52c3894d0
SHA1

422ee70aa729bbc279e39a1dbd4329585d5dee90
SHA256

07c4de5228d721b6ecd076e4fea4a8f1bc55ecc65e7f76e5aed8da390207db7b
SHA512

93c4b86d8fe124a2926f8f1fa84e2bbb96aa41972956e24cc97ed3015044577d179ec9715b8343694712c400aeb30842ad678b5f854081c7d6afbb29c9535bb4
SSDEEP

12288:SWOHbRDDziohgDTw2ZLuFeCshv6Fsgg+:SWOHdD3hmTwKn3hvkg

Score

10^/10

Family

gozi

Family

gozi

Botnet

1500

f1.bablefiler.at

f22.avanoruk.com

Attributes

rsa_pubkey.plain

aes.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3928 wrote to memory of 5112	3928	rundll32.exe	rundll32.exe
PID 3928 wrote to memory of 5112	3928	rundll32.exe	rundll32.exe
PID 3928 wrote to memory of 5112	3928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc6e37e0aed3ddf819bc3db52c3894d0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc6e37e0aed3ddf819bc3db52c3894d0_JaffaCakes118.dll,#1
2⤵
PID:5112

memory/5112-0-0x0000000075650000-0x00000000756DF000-memory.dmp

Filesize
572KB

Download
memory/5112-1-0x0000000075650000-0x00000000756DF000-memory.dmp

Filesize
572KB

Download
memory/5112-2-0x0000000075650000-0x00000000756DF000-memory.dmp

Filesize
572KB

Download
memory/5112-3-0x00000000012D0000-0x00000000012D1000-memory.dmp

Filesize
4KB

Download
memory/5112-4-0x0000000002D10000-0x0000000002D1D000-memory.dmp

Filesize
52KB

Download
memory/5112-7-0x0000000075650000-0x00000000756DF000-memory.dmp

Filesize
572KB

Download