Analysis
-
max time kernel
125s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03/03/2025, 12:57
General
-
Target
41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3.exe
-
Size
9.4MB
-
MD5
e0b8b9c15f6c0b1388373e3e91942d8d
-
SHA1
7bcacdbee55c3eea556d2aa79f04377344a54e47
-
SHA256
41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3
-
SHA512
f1bd73c5f225243ac914054e6ac5ea01c3e9fbe1589ce1d93084c40e0e11c0e35f93c46dec8d270ac44520bac19fd008bd752446427433549bb604c163614e08
-
SSDEEP
98304:udv7AIFM+IJkXHJKZno3XzJ9ktJUs71Saxfz7w3YV:gEIFM+IGXHo+TJ9EBz7w3YV
Score
10/10
Malware Config
Extracted
Family
gozi
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3.exe"C:\Users\Admin\AppData\Local\Temp\41f5338ab7665fd97eee000f1e121c7638913b5f0686e43121cc2c28e6b0ade3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5241⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16.1MB
-
Filesize
3.8MB
-
Filesize
64KB
-
Filesize
16.1MB
-
Filesize
16.1MB
-
Filesize
3.8MB