gozi | d2bd7ecfade73d3122d1bd5a1d4e1334eaf1316f470bbbd529ce30e283634396

Analysis

max time kernel
138s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 11:27

Target

d1b7b6dfaea31d30bcd11c1868ad4600_NeikiAnalytics.exe
Size

364KB
MD5

d1b7b6dfaea31d30bcd11c1868ad4600
SHA1

1e338b4dff5ad9a0e62a6f419bdc4a443a6168aa
SHA256

d2bd7ecfade73d3122d1bd5a1d4e1334eaf1316f470bbbd529ce30e283634396
SHA512

c70502c977e4ab58dce0466c9f42c62550b69ab045733706ae5ff627cec0846558fef8d17c6a0817ea1b3db730362e0c275f4d1e993b844caa7012ba76a749ab
SSDEEP

1536:uhzXF8CvrJ4PBhDP35n6hGlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:ih8k6DP3x6hGltOrWKDBr+yJb

Score

10^/10

Family

gozi

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3972 2392 WerFault.exe d1b7b6dfaea31d30bcd11c1868ad4600_NeikiAnalytics.exe

pid	pid_target	process	target process
3972	2392	WerFault.exe	d1b7b6dfaea31d30bcd11c1868ad4600_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\d1b7b6dfaea31d30bcd11c1868ad4600_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d1b7b6dfaea31d30bcd11c1868ad4600_NeikiAnalytics.exe"
1⤵
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 220
2⤵
- Program crash
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2392 -ip 2392
1⤵
PID:2164

memory/2392-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2392-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download