gozi | e1d63b4e65ef61db22b853686b5dfc4f795047b8701df2f97b0ee40f70e4ce76

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 03:00

Target

9ccba17eddabc2891f70462f7b9f69d4_JaffaCakes118.dll
Size

268KB
MD5

9ccba17eddabc2891f70462f7b9f69d4
SHA1

5bd4c8ea5d92cb2fab2f5228d77250a53eb0eabb
SHA256

e1d63b4e65ef61db22b853686b5dfc4f795047b8701df2f97b0ee40f70e4ce76
SHA512

fef58591062fb94485bf25a05eb93afe66522dc7f49ff57b92f745bf2a30858655baf798169f04228372c46c11f181a865d9d1d6036c21bf5a6b215b2775c20f
SSDEEP

6144:fubsWqPqlal6mPOA7kjR4Z0JUZ581Xvj33IYZuoQs+8pB:fubsPqgl6mPOnRdUZ54/z3IYZuoQs+

Score

10^/10

gozi banker trojan

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rundll32.exe

pid process

1612 rundll32.exe
1612 rundll32.exe

pid	process
1612	rundll32.exe
1612	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1956 wrote to memory of 1612	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1612	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1612	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1612	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1612	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1612	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1612	1956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ccba17eddabc2891f70462f7b9f69d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ccba17eddabc2891f70462f7b9f69d4_JaffaCakes118.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:1612