gozi | 06720acb341873233f025533654f91dcc94a6b9d65ecf4ff4fea9d3594c3743c

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_fcd82795bc29f6f00a006aa18ae60bf9_amadey_elex_smoke-loader.exe
Size 2.3MB
Sample260720-t7a3magt7m
SHA256 06720acb341873233f025533654f91dcc94a6b9d65ecf4ff4fea9d3594c3743c
MD5 fcd82795bc29f6f00a006aa18ae60bf9
SHA1 602e73778a2a9aa4aab15c5feef06566bf046ef3
SHA512 21a206ebcbf28fff252294c21b8a7345564c306783f17c4ba674792161242d9029ad4dfe0e0cc26dd00e06b2ad55be0d88bf1d87e4c3ca647c9df49bc990bcce
SSDEEP 49152:Ooa1taC070UOzN6BIATTY34NyZhTghJCkbFtSy2axvOJFIw4wdvOJFIY:Ooa1taC0/RTVNGJghYU
TLSH
T161B50200B70474F3C614AFB0659AEF97A6106D7B7705ECCB6984528B1CDF6C89B12F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker discovery gozi isfb trojan

Malware Config

Extracted

Family

gozi

Signatures

Family: Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Deletes itself 1 IoCs

pid	Process
2260	7E6.tmp

Executes dropped EXE 1 IoCs

pid	Process
2260	7E6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_fcd82795bc29f6f00a006aa18ae60bf9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7E6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 2260	5668	2026-07-20_fcd82795bc29f6f00a006aa18ae60bf9_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_fcd82795bc29f6f00a006aa18ae60bf9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_fcd82795bc29f6f00a006aa18ae60bf9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Users\Admin\AppData\Local\Temp\7E6.tmp
  "C:\Users\Admin\AppData\Local\Temp\7E6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_fcd82795bc29f6f00a006aa18ae60bf9_amadey_elex_smoke-loader.exe E665C4B563FCA2A3A79BFC9EBA7B1D5C09E2FF08C69899E186E6EF9EE74D54017DC156B54F4081C78ED04193C96B81A70B442B8E01BA0C404CCDB3F81D458CA8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\7E6.tmp
Size 2.3MB
SHA256 506263f93bccf8362f03a0baa338c7ece07f242876565e3272e9f2d9d9825859
MD5 c9ba2f2a70047b71e9cb074562464ab4
SHA1 2f351ec9dfc42d7d7811d5ab2a7513f66ba9e548
SHA512 2691184bd56c61b3f993553ae8244485c77277136b51791381c6db21874bb8cc254ebcc800c95bfd92bf24bd5c5461841987fea9e5296d5f787234a7ceee9651
SSDEEP 49152:Ooa1taC070Ux89PVF50bzJEDzJb8KvoPYuxvOJFIw4wdvOJFIY:Ooa1taC0v89dn0b9EDzp8KvI
TLSH
T134B5F100B70474F3C6156FB0669AEF87A2106DBB3B45ECCB2984569B1CDF6C89B12F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download