gozi | 4743dff7bf5c1aa61b45c2bb674f666c2a02afd2f55112f2e91ef3a86285a628

Analysis

max time kernel
141s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 11:03

Target
a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe
Size 242KB
Sample240612-m5zvmssclc
SHA256 4743dff7bf5c1aa61b45c2bb674f666c2a02afd2f55112f2e91ef3a86285a628
MD5 a06da98b18ab1ba7e28d26918994da08
SHA1 e6c588621bb57f96e37279ca52d11e480bd45eac
SHA512 95ff093583f346754a78027cc4f20c91f2bda467ae0e05d1c7c3ca609a519202cbb8afb69321a369812f48b7f3458e94567b11b70d3db174865e1c695511ffb1
SSDEEP 3072:73DuNsgrBDc1ahPzHykLXX2OQFL9W3aeeFUtxu77euFruksbEF3fpPf+XKFD8T5V:7362grvzSkLHx3eF6xu7T+Ebfqv1V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 436	1696	a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe	81

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 436	1696	a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe	81
PID 1696 wrote to memory of 436	1696	a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe	81
PID 1696 wrote to memory of 436	1696	a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe	81
PID 1696 wrote to memory of 436	1696	a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe	81
PID 1696 wrote to memory of 436	1696	a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe	81
PID 1696 wrote to memory of 436	1696	a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe	81
PID 1696 wrote to memory of 436	1696	a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe	81
PID 1696 wrote to memory of 436	1696	a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe	81
PID 1696 wrote to memory of 436	1696	a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe	81
PID 1696 wrote to memory of 436	1696	a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a06da98b18ab1ba7e28d26918994da08_JaffaCakes118.exe"
  2⤵
  PID:436

memory/436-2-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/436-4-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/436-5-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/436-8-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1696-1-0x00000000005F0000-0x00000000006F0000-memory.dmp

Download