gozi | d9bd9e8b091f780a96f56d84c4727b89a2e2413007f6337aed04a9970081db87

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 17:34

Target

95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe
Size

733KB
MD5

95b3df629486f52dc64c2c38ba49b9f6
SHA1

e4ca6bf835d00975cc2b41fc45c7d7a473b7eb8c
SHA256

d9bd9e8b091f780a96f56d84c4727b89a2e2413007f6337aed04a9970081db87
SHA512

aafcfa574b6dc9844a7c50515d5a1d5d89ad710009438314c1cf2b6d920b63c95f632b626109f2c3e1d0ace34d578e271b6cea11f479a264e0c9353e8801c1c2
SSDEEP

12288:n6TNQkTwso08kB9o/MJmjKiqHIyKnFioFheYexAX7s6tWeRY45CLEJCenEPReTS/:n6yqa61Jm+HnKnQEjKAJtWf45kkCeEPT

Score

10^/10

Family

gozi

Attributes

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4968-0-0x0000000000400000-0x00000000005B1000-memory.dmp	upx
behavioral2/memory/4968-1-0x0000000000400000-0x00000000005B1000-memory.dmp	upx
behavioral2/memory/4968-4-0x0000000000400000-0x00000000005B1000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe

pid process

4968 95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe

pid	process
4968	95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\95b3df629486f52dc64c2c38ba49b9f6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3688

memory/4968-0-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/4968-1-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/4968-5-0x0000000002C20000-0x0000000002CA0000-memory.dmp

Filesize
512KB

Download
memory/4968-4-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/4968-6-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

Filesize
4KB

Download
memory/4968-7-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

Filesize
4KB

Download
memory/4968-8-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

Filesize
4KB

Download
memory/4968-9-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

Filesize
4KB

Download
memory/4968-10-0x0000000002C20000-0x0000000002CA0000-memory.dmp

Filesize
512KB

Download
memory/4968-11-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/4968-12-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download