IOC Report
gozi_loader.bin.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\gozi_loader.bin.exe
C:\Users\user\Desktop\gozi_loader.bin.exe
malicious

URLs

Name
IP
Malicious
http://checklist.skype.com/drew/YJnT5wK9lbi_2FYe8Kf5y/QYTs_2B6r_2FF8l0/fLw2xZG1XgX5PrO/q_2Bnf6Otc_2F
unknown
http://62.173.141.252/drew/y3O_2BnUepUaUzeF4C/FRcN_2F0g/JenmUZWHq05STtkRb5sf/OjHYpR2L_2F2jEOkrjw/2V_
unknown
http://62.173
unknown
http://ctldl.windowsup-k
unknown
http://62.173.141.252/t
unknown

Domains

Name
IP
Malicious
checklist.skype.com
unknown

IPs

IP
Domain
Country
Malicious
62.173.141.252
unknown
Russian Federation

Memdumps

Base Address
Regiontype
Protect
Malicious
1348000
heap
page read and write
malicious
1348000
heap
page read and write
malicious
1348000
heap
page read and write
malicious
1348000
heap
page read and write
malicious
1348000
heap
page read and write
malicious
1348000
heap
page read and write
malicious
1348000
heap
page read and write
malicious
1348000
heap
page read and write
malicious
1348000
heap
page read and write
malicious
400000
unkown
page readonly
129DD654000
heap
page read and write
30CF000
stack
page read and write
129DE023000
heap
page read and write
403000
unkown
page readonly
129DD7B9000
heap
page read and write
32CD000
stack
page read and write
1B0C2FF000
stack
page read and write
940000
heap
page read and write
1EED5C90000
trusted library allocation
page read and write
E8E000
stack
page read and write
2DAC7713000
heap
page read and write
1EED5D00000
trusted library allocation
page read and write
24704C3E000
heap
page read and write
8CA68FE000
stack
page read and write
24704C13000
heap
page read and write
8CA66FB000
stack
page read and write
1CA1A445000
heap
page read and write
1CA1A474000
heap
page read and write
D8983FE000
stack
page read and write
2CA6F45C000
heap
page read and write
2DAC7662000
heap
page read and write
1F5B5E40000
heap
page read and write
FEC31FE000
stack
page read and write
F50000
heap
page read and write
129DDF94000
heap
page read and write
1EED4160000
heap
page read and write
401000
unkown
page execute read
D38000
heap
page read and write
1EED426D000
heap
page read and write
1F5B5EB0000
heap
page read and write
1CA1A442000
heap
page read and write
24704C66000
heap
page read and write
2DAC7600000
heap
page read and write
1B0BEF9000
stack
page read and write
129DDE02000
heap
page read and write
D38000
heap
page read and write
1EED431B000
heap
page read and write
D89827F000
stack
page read and write
1CA1A464000
heap
page read and write
1CA1A47D000
heap
page read and write
1A6F863E000
heap
page read and write
2DAC74B0000
heap
page read and write
2DAC7676000
heap
page read and write
129DD7E5000
heap
page read and write
D38000
heap
page read and write
1A6F8646000
heap
page read and write
134B000
heap
page read and write
2DAC7640000
heap
page read and write
129DD560000
heap
page read and write
129DDFC7000
heap
page read and write
8C3A77E000
stack
page read and write
31CF000
stack
page read and write
129DD63D000
heap
page read and write
775000
heap
page read and write
2CA6F502000
heap
page read and write
1EED426C000
heap
page read and write
1F5B6802000
trusted library allocation
page read and write
1CA1A2C0000
heap
page read and write
8CA667D000
stack
page read and write
2CA6F2F0000
heap
page read and write
2DAC7440000
heap
page read and write
1EED4300000
heap
page read and write
1EED4213000
heap
page read and write
129DDF6F000
heap
page read and write
1EED4313000
heap
page read and write
425E6FE000
stack
page read and write
1CA1A475000
heap
page read and write
425E3F9000
stack
page read and write
1F5B6079000
heap
page read and write
1A6F8600000
heap
page read and write
6FC000
stack
page read and write
129DD629000
heap
page read and write
1F5B6002000
heap
page read and write
B3A227F000
stack
page read and write
2CA6F429000
heap
page read and write
8C3A37F000
stack
page read and write
FEC2BFE000
stack
page read and write
2DAC7450000
heap
page read and write
33CA000
stack
page read and write