Overview
overview
10Static
static
2021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
12021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
102021021216...in.dll
windows10_x64
102021021216...in.dll
windows7_x64
12021021216...in.dll
windows10_x64
10Analysis
-
max time kernel
44s -
max time network
10s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-02-2021 19:50
Static task
static1
Behavioral task
behavioral1
Sample
202102121641_48eacf290c0ed6287672551fcf426053f754c126c01fe6a01009c0ba599d3b8f.bin.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
202102121641_48eacf290c0ed6287672551fcf426053f754c126c01fe6a01009c0ba599d3b8f.bin.dll
Resource
win10v20201028
Behavioral task
behavioral3
Sample
202102121641_4b32c3c2d28237ba331ae94e7fe4dfb566a0902d59eb84aa793b3adf0a5f378c.bin.dll
Resource
win7v20201028
Behavioral task
behavioral4
Sample
202102121641_4b32c3c2d28237ba331ae94e7fe4dfb566a0902d59eb84aa793b3adf0a5f378c.bin.dll
Resource
win10v20201028
Behavioral task
behavioral5
Sample
202102121641_7ae7db00b573a89b9c435a5147a265dd939d99552b92b5dd9baa9a16f95ae9d5.bin.dll
Resource
win7v20201028
Behavioral task
behavioral6
Sample
202102121641_7ae7db00b573a89b9c435a5147a265dd939d99552b92b5dd9baa9a16f95ae9d5.bin.dll
Resource
win10v20201028
Behavioral task
behavioral7
Sample
202102121641_8600b6aff4ee95d4f78e5dc77f66af3c07241db926b053144943361bc64c37f7.bin.dll
Resource
win7v20201028
Behavioral task
behavioral8
Sample
202102121641_8600b6aff4ee95d4f78e5dc77f66af3c07241db926b053144943361bc64c37f7.bin.dll
Resource
win10v20201028
Behavioral task
behavioral9
Sample
202102121641_ae55975bd40147ab3b9a02f1e2e0279f714bce9845d26ace252cd590a42d733d.bin.dll
Resource
win7v20201028
Behavioral task
behavioral10
Sample
202102121641_ae55975bd40147ab3b9a02f1e2e0279f714bce9845d26ace252cd590a42d733d.bin.dll
Resource
win10v20201028
Behavioral task
behavioral11
Sample
202102121641_c642dca14e48cae8391d5f100304b399b70a9c3967d7b7d3949ead3b96ba1a63.bin.dll
Resource
win7v20201028
Behavioral task
behavioral12
Sample
202102121641_c642dca14e48cae8391d5f100304b399b70a9c3967d7b7d3949ead3b96ba1a63.bin.dll
Resource
win10v20201028
Behavioral task
behavioral13
Sample
202102121641_cc849b895a0c8237f81ca3fe6395929713fb7b3f0a7744d3ddc3cb08f9f4351d.bin.dll
Resource
win7v20201028
Behavioral task
behavioral14
Sample
202102121641_cc849b895a0c8237f81ca3fe6395929713fb7b3f0a7744d3ddc3cb08f9f4351d.bin.dll
Resource
win10v20201028
Behavioral task
behavioral15
Sample
202102121641_f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73.bin.dll
Resource
win7v20201028
General
-
Target
202102121641_cc849b895a0c8237f81ca3fe6395929713fb7b3f0a7744d3ddc3cb08f9f4351d.bin.dll
-
Size
596KB
-
MD5
e07d47927df912332bc84b3f98586091
-
SHA1
b55a9ae7a9ccd44dd3516e557e295e3f1cce750e
-
SHA256
cc849b895a0c8237f81ca3fe6395929713fb7b3f0a7744d3ddc3cb08f9f4351d
-
SHA512
05fc68821232f43b1b598a5c3989d18e5487f87316803a8d2e732cd1afed88034f6482be256c9894a4a56b6fe4efdec748a982c90c7609c64d24ff77b5b56396
Malware Config
Extracted
gozi_ifsb
2200
api10.laptok.at/api1
golang.feel500.at/api1
go.in100k.at/api1
-
build
250171
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
730
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 384 wrote to memory of 1812 384 rundll32.exe rundll32.exe PID 384 wrote to memory of 1812 384 rundll32.exe rundll32.exe PID 384 wrote to memory of 1812 384 rundll32.exe rundll32.exe PID 384 wrote to memory of 1812 384 rundll32.exe rundll32.exe PID 384 wrote to memory of 1812 384 rundll32.exe rundll32.exe PID 384 wrote to memory of 1812 384 rundll32.exe rundll32.exe PID 384 wrote to memory of 1812 384 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\202102121641_cc849b895a0c8237f81ca3fe6395929713fb7b3f0a7744d3ddc3cb08f9f4351d.bin.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\202102121641_cc849b895a0c8237f81ca3fe6395929713fb7b3f0a7744d3ddc3cb08f9f4351d.bin.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1812-2-0x0000000000000000-mapping.dmp
-
memory/1812-3-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB
-
memory/1812-4-0x0000000010000000-0x000000001000F000-memory.dmpFilesize
60KB
-
memory/1812-5-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB