gozi | 3946ef3c61a85bb5948517f03097c1907cf61413787d7a88b3787c8661ae28d6

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 03:23

Target

742f3846a6e44b98c44617f872865400_JaffaCakes118.exe
Size

347KB
MD5

742f3846a6e44b98c44617f872865400
SHA1

f42f52c9a84c9548c359ffeef38efcd04531e5e5
SHA256

3946ef3c61a85bb5948517f03097c1907cf61413787d7a88b3787c8661ae28d6
SHA512

8288bc1e77d5a3d29e69a7d837833c0480e78a08366e299a5b5af1d70942650c77f375625c53b5a2200ac094bc0a015b029931dae20d1900194164676d548b91
SSDEEP

6144:dy7lP+VcwAXSPnzpDA4uoHftmvNQmhssD7Se97CWVcSuJ6xuN8Eo+:mlPsTvzpDtu4fcNrOsD7Se9G/Jw+p

Score

10^/10

Family

gozi

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
656	32	WerFault.exe	742f3846a6e44b98c44617f872865400_JaffaCakes118.exe
3260	32	WerFault.exe	742f3846a6e44b98c44617f872865400_JaffaCakes118.exe
4540	32	WerFault.exe	742f3846a6e44b98c44617f872865400_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\742f3846a6e44b98c44617f872865400_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\742f3846a6e44b98c44617f872865400_JaffaCakes118.exe"
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 484
2⤵
- Program crash
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 492
2⤵
- Program crash
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 508
2⤵
- Program crash
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 32 -ip 32
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 32 -ip 32
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 32 -ip 32
1⤵
PID:5100

memory/32-0-0x0000000000710000-0x0000000000749000-memory.dmp

Filesize
228KB

Download
memory/32-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/32-4-0x0000000000750000-0x000000000078B000-memory.dmp

Filesize
236KB

Download
memory/32-11-0x0000000000750000-0x000000000078B000-memory.dmp

Filesize
236KB

Download
memory/32-12-0x0000000000750000-0x000000000078B000-memory.dmp

Filesize
236KB

Download
memory/32-13-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download