gozi | 70f0516575cb8fc5f70f0fc4d463db9db35a114518043410f1d03d5fdba46a0d

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe
Size

520KB
MD5

04d1aed5d8791c7e4f7038ae63c1792c
SHA1

4d9f359fa2ba9e47e825d32c7792c1b34be9d4b0
SHA256

70f0516575cb8fc5f70f0fc4d463db9db35a114518043410f1d03d5fdba46a0d
SHA512

1c180223a102e7deb530b1fb56cbfd39dae57453c328df8382728ccf6b7bfc4506b5176d190d23c93838b57a5988f663b17d72213c8b3215963353fbfcf56dee
SSDEEP

12288:bJ3Y9cNKkdhHSeFAEsbfu+Hvf9mn1WpNtTirdG:bdYKNKkGzbG+InkNTEdG

Score

10^/10

gozi banker isfb trojan

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Suspicious use of SetThreadContext 1 IoCs

Processes:

04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe

description pid process target process

PID 4220 set thread context of 528 4220 04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe 04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe

pid process

4220 04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe

description	pid	process	target process
PID 4220 set thread context of 528	4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE

pid	process
4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe

description	pid	process	target process
PID 4220 wrote to memory of 528	4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE
PID 4220 wrote to memory of 528	4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE
PID 4220 wrote to memory of 528	4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE
PID 4220 wrote to memory of 528	4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE
PID 4220 wrote to memory of 528	4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE
PID 4220 wrote to memory of 528	4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE
PID 4220 wrote to memory of 528	4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE
PID 4220 wrote to memory of 528	4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE
PID 4220 wrote to memory of 528	4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE
PID 4220 wrote to memory of 528	4220	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe	04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE

C:\Users\Admin\AppData\Local\Temp\04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220

C:\Users\Admin\AppData\Local\Temp\04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE
"C:\Users\Admin\AppData\Local\Temp\04d1aed5d8791c7e4f7038ae63c1792c_JaffaCakes118.EXE"
2⤵
PID:528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/528-94-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/528-96-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/528-95-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/528-105-0x0000000001F80000-0x0000000001FCA000-memory.dmp

Filesize
296KB

Download
memory/528-112-0x0000000001F80000-0x0000000001FCA000-memory.dmp

Filesize
296KB

Download
memory/4220-28-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/4220-16-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download
memory/4220-5-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/4220-9-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/4220-8-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/4220-7-0x0000000002400000-0x0000000002402000-memory.dmp

Filesize
8KB

Download
memory/4220-6-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/4220-4-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/4220-3-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4220-2-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/4220-21-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/4220-25-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download
memory/4220-24-0x0000000002F20000-0x0000000002F21000-memory.dmp

Filesize
4KB

Download
memory/4220-23-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Filesize
4KB

Download
memory/4220-22-0x0000000002F00000-0x0000000002F01000-memory.dmp

Filesize
4KB

Download
memory/4220-20-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Filesize
4KB

Download
memory/4220-19-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/4220-18-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/4220-17-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/4220-54-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4220-15-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Filesize
4KB

Download
memory/4220-14-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4220-13-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/4220-12-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4220-27-0x0000000002F30000-0x0000000002F31000-memory.dmp

Filesize
4KB

Download
memory/4220-47-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download
memory/4220-46-0x0000000003080000-0x0000000003081000-memory.dmp

Filesize
4KB

Download
memory/4220-53-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/4220-44-0x0000000003060000-0x0000000003061000-memory.dmp

Filesize
4KB

Download
memory/4220-43-0x0000000003030000-0x0000000003031000-memory.dmp

Filesize
4KB

Download
memory/4220-42-0x0000000003040000-0x0000000003041000-memory.dmp

Filesize
4KB

Download
memory/4220-41-0x0000000003010000-0x0000000003011000-memory.dmp

Filesize
4KB

Download
memory/4220-40-0x0000000003020000-0x0000000003021000-memory.dmp

Filesize
4KB

Download
memory/4220-39-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download
memory/4220-38-0x0000000003000000-0x0000000003001000-memory.dmp

Filesize
4KB

Download
memory/4220-37-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/4220-36-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/4220-35-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/4220-34-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

Filesize
4KB

Download
memory/4220-33-0x0000000002F90000-0x0000000002F91000-memory.dmp

Filesize
4KB

Download
memory/4220-32-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Filesize
4KB

Download
memory/4220-31-0x0000000002F70000-0x0000000002F71000-memory.dmp

Filesize
4KB

Download
memory/4220-30-0x0000000002F80000-0x0000000002F81000-memory.dmp

Filesize
4KB

Download
memory/4220-0-0x0000000000400000-0x0000000000576000-memory.dmp

Filesize
1.5MB

Download
memory/4220-29-0x0000000002F50000-0x0000000002F51000-memory.dmp

Filesize
4KB

Download
memory/4220-26-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/4220-80-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/4220-1-0x0000000002210000-0x0000000002253000-memory.dmp

Filesize
268KB

Download
memory/4220-45-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/4220-52-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/4220-51-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/4220-50-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/4220-49-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4220-48-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/4220-63-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/4220-62-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/4220-61-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/4220-60-0x0000000003460000-0x0000000003461000-memory.dmp

Filesize
4KB

Download
memory/4220-59-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/4220-58-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/4220-57-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/4220-56-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/4220-79-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/4220-78-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4220-77-0x0000000003C70000-0x0000000003C71000-memory.dmp

Filesize
4KB

Download
memory/4220-76-0x0000000003C80000-0x0000000003C81000-memory.dmp

Filesize
4KB

Download
memory/4220-75-0x0000000003B20000-0x0000000003B21000-memory.dmp

Filesize
4KB

Download
memory/4220-74-0x0000000003B30000-0x0000000003B31000-memory.dmp

Filesize
4KB

Download
memory/4220-73-0x00000000039D0000-0x00000000039D1000-memory.dmp

Filesize
4KB

Download
memory/4220-72-0x00000000039E0000-0x00000000039E1000-memory.dmp

Filesize
4KB

Download
memory/4220-71-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download
memory/4220-70-0x00000000039C0000-0x00000000039C1000-memory.dmp

Filesize
4KB

Download
memory/4220-69-0x0000000003990000-0x0000000003991000-memory.dmp

Filesize
4KB

Download
memory/4220-68-0x00000000039A0000-0x00000000039A1000-memory.dmp

Filesize
4KB

Download
memory/4220-67-0x0000000003970000-0x0000000003971000-memory.dmp

Filesize
4KB

Download
memory/4220-66-0x0000000003980000-0x0000000003981000-memory.dmp

Filesize
4KB

Download
memory/4220-65-0x0000000003950000-0x0000000003951000-memory.dmp

Filesize
4KB

Download
memory/4220-64-0x0000000003960000-0x0000000003961000-memory.dmp

Filesize
4KB

Download
memory/4220-91-0x00000000039F0000-0x00000000039F1000-memory.dmp

Filesize
4KB

Download
memory/4220-90-0x0000000003A00000-0x0000000003A01000-memory.dmp

Filesize
4KB

Download
memory/4220-89-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/4220-88-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/4220-87-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/4220-86-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/4220-85-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/4220-84-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/4220-83-0x00000000034B0000-0x00000000034B1000-memory.dmp

Filesize
4KB

Download
memory/4220-82-0x00000000034C0000-0x00000000034C1000-memory.dmp

Filesize
4KB

Download
memory/4220-81-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/4220-55-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4220-92-0x0000000000400000-0x0000000000576000-memory.dmp

Filesize
1.5MB

Download
memory/4220-93-0x0000000002210000-0x0000000002253000-memory.dmp

Filesize
268KB

Download
memory/4220-100-0x0000000002210000-0x0000000002253000-memory.dmp

Filesize
268KB

Download
memory/4220-99-0x0000000000400000-0x0000000000576000-memory.dmp

Filesize
1.5MB

Download