gozi | eaf59a5f7ee285a410f2cfbbf75befa377e195eee7a931b5da28ed01689598ab

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3fyc1Yqrm.exe
Size

14.8MB
MD5

b7eb4e534c7d36dee723a23f7e59c330
SHA1

6566cdb7eb847ca3a8c4d9a5f2731bca60fcf86b
SHA256

eaf59a5f7ee285a410f2cfbbf75befa377e195eee7a931b5da28ed01689598ab
SHA512

016dabb5ed9597d83868f6e34f419a041d534bccca64d4a157c457c892dc87d28499bc97449fdda3cd256f9afee071e0cd3e2529ab89541a91c4aeb90f9eb1e9
SSDEEP

393216:RCzOIKxEfqPNsBcka0VdhVhMKC0MJBdJzoCQs/MG8:ROKuTpVdhVhM7ndRooMG8

Score

10^/10

gozi banker isfb trojan

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe
2576	e3fyc1Yqrm.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2576	e3fyc1Yqrm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1704	2576	e3fyc1Yqrm.exe	31
PID 2576 wrote to memory of 1704	2576	e3fyc1Yqrm.exe	31
PID 2576 wrote to memory of 1704	2576	e3fyc1Yqrm.exe	31
PID 2576 wrote to memory of 2136	2576	e3fyc1Yqrm.exe	32
PID 2576 wrote to memory of 2136	2576	e3fyc1Yqrm.exe	32
PID 2576 wrote to memory of 2136	2576	e3fyc1Yqrm.exe	32
PID 2576 wrote to memory of 2100	2576	e3fyc1Yqrm.exe	33
PID 2576 wrote to memory of 2100	2576	e3fyc1Yqrm.exe	33
PID 2576 wrote to memory of 2100	2576	e3fyc1Yqrm.exe	33
PID 2576 wrote to memory of 2128	2576	e3fyc1Yqrm.exe	35
PID 2576 wrote to memory of 2128	2576	e3fyc1Yqrm.exe	35
PID 2576 wrote to memory of 2128	2576	e3fyc1Yqrm.exe	35
PID 2576 wrote to memory of 2296	2576	e3fyc1Yqrm.exe	36
PID 2576 wrote to memory of 2296	2576	e3fyc1Yqrm.exe	36
PID 2576 wrote to memory of 2296	2576	e3fyc1Yqrm.exe	36
PID 2576 wrote to memory of 2776	2576	e3fyc1Yqrm.exe	37
PID 2576 wrote to memory of 2776	2576	e3fyc1Yqrm.exe	37
PID 2576 wrote to memory of 2776	2576	e3fyc1Yqrm.exe	37
PID 2576 wrote to memory of 2736	2576	e3fyc1Yqrm.exe	38
PID 2576 wrote to memory of 2736	2576	e3fyc1Yqrm.exe	38
PID 2576 wrote to memory of 2736	2576	e3fyc1Yqrm.exe	38
PID 2576 wrote to memory of 2836	2576	e3fyc1Yqrm.exe	39
PID 2576 wrote to memory of 2836	2576	e3fyc1Yqrm.exe	39
PID 2576 wrote to memory of 2836	2576	e3fyc1Yqrm.exe	39
PID 2576 wrote to memory of 2840	2576	e3fyc1Yqrm.exe	40
PID 2576 wrote to memory of 2840	2576	e3fyc1Yqrm.exe	40
PID 2576 wrote to memory of 2840	2576	e3fyc1Yqrm.exe	40
PID 2576 wrote to memory of 2868	2576	e3fyc1Yqrm.exe	41
PID 2576 wrote to memory of 2868	2576	e3fyc1Yqrm.exe	41
PID 2576 wrote to memory of 2868	2576	e3fyc1Yqrm.exe	41
PID 2576 wrote to memory of 2880	2576	e3fyc1Yqrm.exe	42
PID 2576 wrote to memory of 2880	2576	e3fyc1Yqrm.exe	42
PID 2576 wrote to memory of 2880	2576	e3fyc1Yqrm.exe	42
PID 2576 wrote to memory of 2996	2576	e3fyc1Yqrm.exe	43
PID 2576 wrote to memory of 2996	2576	e3fyc1Yqrm.exe	43
PID 2576 wrote to memory of 2996	2576	e3fyc1Yqrm.exe	43
PID 2576 wrote to memory of 2784	2576	e3fyc1Yqrm.exe	44
PID 2576 wrote to memory of 2784	2576	e3fyc1Yqrm.exe	44
PID 2576 wrote to memory of 2784	2576	e3fyc1Yqrm.exe	44
PID 2576 wrote to memory of 2988	2576	e3fyc1Yqrm.exe	45
PID 2576 wrote to memory of 2988	2576	e3fyc1Yqrm.exe	45
PID 2576 wrote to memory of 2988	2576	e3fyc1Yqrm.exe	45
PID 2576 wrote to memory of 2636	2576	e3fyc1Yqrm.exe	46
PID 2576 wrote to memory of 2636	2576	e3fyc1Yqrm.exe	46
PID 2576 wrote to memory of 2636	2576	e3fyc1Yqrm.exe	46
PID 2576 wrote to memory of 2268	2576	e3fyc1Yqrm.exe	47
PID 2576 wrote to memory of 2268	2576	e3fyc1Yqrm.exe	47
PID 2576 wrote to memory of 2268	2576	e3fyc1Yqrm.exe	47
PID 2576 wrote to memory of 2372	2576	e3fyc1Yqrm.exe	48
PID 2576 wrote to memory of 2372	2576	e3fyc1Yqrm.exe	48
PID 2576 wrote to memory of 2372	2576	e3fyc1Yqrm.exe	48
PID 2576 wrote to memory of 2932	2576	e3fyc1Yqrm.exe	49
PID 2576 wrote to memory of 2932	2576	e3fyc1Yqrm.exe	49
PID 2576 wrote to memory of 2932	2576	e3fyc1Yqrm.exe	49
PID 2576 wrote to memory of 2748	2576	e3fyc1Yqrm.exe	50
PID 2576 wrote to memory of 2748	2576	e3fyc1Yqrm.exe	50
PID 2576 wrote to memory of 2748	2576	e3fyc1Yqrm.exe	50
PID 2576 wrote to memory of 2816	2576	e3fyc1Yqrm.exe	51
PID 2576 wrote to memory of 2816	2576	e3fyc1Yqrm.exe	51
PID 2576 wrote to memory of 2816	2576	e3fyc1Yqrm.exe	51
PID 2576 wrote to memory of 2920	2576	e3fyc1Yqrm.exe	52
PID 2576 wrote to memory of 2920	2576	e3fyc1Yqrm.exe	52
PID 2576 wrote to memory of 2920	2576	e3fyc1Yqrm.exe	52
PID 2576 wrote to memory of 2272	2576	e3fyc1Yqrm.exe	53

C:\Users\Admin\AppData\Local\Temp\e3fyc1Yqrm.exe
"C:\Users\Admin\AppData\Local\Temp\e3fyc1Yqrm.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-0-0x000000013F4FE000-0x000000013FD6C000-memory.dmp

Filesize
8.4MB

Download
memory/2576-1-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

Filesize
8KB

Download
memory/2576-10-0x0000000076FE0000-0x0000000076FE2000-memory.dmp

Filesize
8KB

Download
memory/2576-8-0x0000000076FE0000-0x0000000076FE2000-memory.dmp

Filesize
8KB

Download
memory/2576-6-0x0000000076FE0000-0x0000000076FE2000-memory.dmp

Filesize
8KB

Download
memory/2576-5-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

Filesize
8KB

Download
memory/2576-3-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

Filesize
8KB

Download
memory/2576-11-0x000000013F2C0000-0x0000000140C3C000-memory.dmp

Filesize
25.5MB

Download
memory/2576-14-0x000000013F2C0000-0x0000000140C3C000-memory.dmp

Filesize
25.5MB

Download
memory/2576-15-0x000000013F4FE000-0x000000013FD6C000-memory.dmp

Filesize
8.4MB

Download