gozi | 042d17bec0bdc75cdb620ba62bc72140c9486c9c1eeb35edec24972498c5dc45

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-06-2024 14:13

Target

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
Size

107KB
MD5

0c2b04e4091af239fb80d7b2aab6f0c9
SHA1

dc52874aacf3be3b463cac375bd471e13ff260ed
SHA256

042d17bec0bdc75cdb620ba62bc72140c9486c9c1eeb35edec24972498c5dc45
SHA512

1a9762d4703e23e6f31bb4b163197470c7cb308ea7b16b77a0fd58563a796d8d099c2f0d294fe396ddf3be1213e6df60add4f78a25cd5ec73aea0597f4144918
SSDEEP

3072:HRO6Hu0ILzqLrMTWeZvTE1yWZf/QsMwf:HRNHu0mqLrLexWx/J

Score

10^/10

Family

gozi

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3068 2996 WerFault.exe 0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

pid	pid_target	process	target process
3068	2996	WerFault.exe	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe

description	pid	process	target process
PID 2996 wrote to memory of 3068	2996	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe	WerFault.exe
PID 2996 wrote to memory of 3068	2996	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe	WerFault.exe
PID 2996 wrote to memory of 3068	2996	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe	WerFault.exe
PID 2996 wrote to memory of 3068	2996	0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c2b04e4091af239fb80d7b2aab6f0c9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 160
2⤵
- Program crash
PID:3068

memory/2996-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2996-4-0x00000000003C0000-0x00000000003F0000-memory.dmp

Filesize
192KB

Download
memory/2996-3-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2996-2-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2996-1-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2996-5-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download