gozi | a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
Size

596KB
MD5

50aca2f93f28f6408d7d3b5f46c8d963
SHA1

c8fbb2524a096d4308807f99b8b80a13ce9d3512
SHA256

a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5
SHA512

34f74434954748081f18b4933b51f6b0b6da6b7223359ac6d587e9ac1f5e6308a4c975e800cca09562476be896328b82cbc0dbcfdf276f89ab8a104097752b2a
SSDEEP

12288:xqLD9LU7ncQwcj9cqMcNySlSwpQ/FsD61:xqQnHjG1hbODq

Score

10^/10

gozi banker isfb trojan

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe

pid	process
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
2020	a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe

C:\Users\Admin\AppData\Local\Temp\a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe
"C:\Users\Admin\AppData\Local\Temp\a969b652028c0955e8416bcaf485fdcc8bafad05694fc69853e4a090f01b3eb5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2020

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-0-0x0000000002E40000-0x0000000002EC4000-memory.dmp

Filesize
528KB

Download
memory/2020-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2020-2-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2020-3-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2020-4-0x0000000002E40000-0x0000000002EC4000-memory.dmp

Filesize
528KB

Download
memory/2020-5-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2020-6-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2020-7-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2020-8-0x0000000002370000-0x00000000023B4000-memory.dmp

Filesize
272KB

Download
memory/2020-15-0x0000000002370000-0x00000000023B4000-memory.dmp

Filesize
272KB

Download
memory/2020-16-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads