gozi | eaf59a5f7ee285a410f2cfbbf75befa377e195eee7a931b5da28ed01689598ab

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 16:10

Target

e3fyc1Yqrm.exe
Size

14.8MB
MD5

b7eb4e534c7d36dee723a23f7e59c330
SHA1

6566cdb7eb847ca3a8c4d9a5f2731bca60fcf86b
SHA256

eaf59a5f7ee285a410f2cfbbf75befa377e195eee7a931b5da28ed01689598ab
SHA512

016dabb5ed9597d83868f6e34f419a041d534bccca64d4a157c457c892dc87d28499bc97449fdda3cd256f9afee071e0cd3e2529ab89541a91c4aeb90f9eb1e9
SSDEEP

393216:RCzOIKxEfqPNsBcka0VdhVhMKC0MJBdJzoCQs/MG8:ROKuTpVdhVhM7ndRooMG8

Score

10^/10

Family

gozi

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3248	e3fyc1Yqrm.exe
3248	e3fyc1Yqrm.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3248	e3fyc1Yqrm.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 3784	3248	e3fyc1Yqrm.exe	87
PID 3248 wrote to memory of 3784	3248	e3fyc1Yqrm.exe	87
PID 3248 wrote to memory of 2384	3248	e3fyc1Yqrm.exe	92
PID 3248 wrote to memory of 2384	3248	e3fyc1Yqrm.exe	92
PID 3248 wrote to memory of 4956	3248	e3fyc1Yqrm.exe	94
PID 3248 wrote to memory of 4956	3248	e3fyc1Yqrm.exe	94
PID 3248 wrote to memory of 712	3248	e3fyc1Yqrm.exe	97
PID 3248 wrote to memory of 712	3248	e3fyc1Yqrm.exe	97
PID 3248 wrote to memory of 3736	3248	e3fyc1Yqrm.exe	98
PID 3248 wrote to memory of 3736	3248	e3fyc1Yqrm.exe	98

C:\Users\Admin\AppData\Local\Temp\e3fyc1Yqrm.exe
"C:\Users\Admin\AppData\Local\Temp\e3fyc1Yqrm.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3736

memory/3248-0-0x00007FF6B21AE000-0x00007FF6B2A1C000-memory.dmp

Filesize
8.4MB

Download
memory/3248-2-0x00007FFC6F3A0000-0x00007FFC6F3A2000-memory.dmp

Filesize
8KB

Download
memory/3248-1-0x00007FFC6F390000-0x00007FFC6F392000-memory.dmp

Filesize
8KB

Download
memory/3248-6-0x00007FF6B1F70000-0x00007FF6B38EC000-memory.dmp

Filesize
25.5MB

Download
memory/3248-7-0x00007FF6B1F70000-0x00007FF6B38EC000-memory.dmp

Filesize
25.5MB

Download
memory/3248-9-0x00007FF6B21AE000-0x00007FF6B2A1C000-memory.dmp

Filesize
8.4MB

Download