gozi | 0afee760ec1546ab9e42ef64b10a8c2dc002ed521975a594236fdadffa8943e3

Analysis

max time kernel
93s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 02:31

Target

cfdfcc3c74fbf77851db6fffaed54960_NEIKI.exe
Size

364KB
MD5

cfdfcc3c74fbf77851db6fffaed54960
SHA1

b66155680365dfdb89bb44afc80e509479587026
SHA256

0afee760ec1546ab9e42ef64b10a8c2dc002ed521975a594236fdadffa8943e3
SHA512

6c38cba59adcefb4b546a7b61670d855a756b00f4b08fd3a6c6a1231daf67f4c3a1c43a80829b6c3fc4ed9a0bddb0853478fb5665e67a36cf64c5c06299567f4
SSDEEP

1536:/izXF8CvrJ4PBhDP35p6hRlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:/ih8k6DP3T6hRltOrWKDBr+yJb

Score

10^/10

Family

gozi

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

220 440 WerFault.exe cfdfcc3c74fbf77851db6fffaed54960_NEIKI.exe

pid	pid_target	process	target process
220	440	WerFault.exe	cfdfcc3c74fbf77851db6fffaed54960_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\cfdfcc3c74fbf77851db6fffaed54960_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\cfdfcc3c74fbf77851db6fffaed54960_NEIKI.exe"
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 220
2⤵
- Program crash
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 440 -ip 440
1⤵
PID:2644

memory/440-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/440-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download