gozi | eac2aee6b368e21e8268c0b43dede5b863e75db8f8815d6011e9cc91d2d04334

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 11:09

Target

54645e480f42f0fd6553dd84925fc652_JaffaCakes118.dll
Size

185KB
MD5

54645e480f42f0fd6553dd84925fc652
SHA1

55549ff0d413f169796023c502fb29e72d2217e1
SHA256

eac2aee6b368e21e8268c0b43dede5b863e75db8f8815d6011e9cc91d2d04334
SHA512

ce3bb4c95bd9fba4a46c111c6ed312fcf0404029ee9ada7c74473a5efd0450a08061d1e30d66a2d8d0799749576df534d892fcbec5d028e620e4d7b4f305a094
SSDEEP

3072:eu94wHeYVfD93uh/TATDB4GbUQwTOuAjOBXmBj4/s2NUamijQ+dk4a:R4/WD96oOGLuOzjYem/+F5e

Score

10^/10

Family

gozi

Attributes

Family

gozi

Botnet

1000

http://form-updater.at

Attributes

rsa_pubkey.plain

serpent.plain

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2344 wrote to memory of 2348	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2348	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2348	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2348	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2348	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2348	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2348	2344	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54645e480f42f0fd6553dd84925fc652_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54645e480f42f0fd6553dd84925fc652_JaffaCakes118.dll,#1
2⤵
PID:2348

memory/2348-0-0x0000000074B20000-0x0000000074C4D000-memory.dmp

Filesize
1.2MB

Download
memory/2348-1-0x0000000074B3D000-0x0000000074B40000-memory.dmp

Filesize
12KB

Download
memory/2348-5-0x0000000074B20000-0x0000000074C4D000-memory.dmp

Filesize
1.2MB

Download
memory/2348-2-0x0000000000220000-0x000000000022F000-memory.dmp

Filesize
60KB

Download