Analysis
-
max time kernel
88s -
max time network
44s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-03-2021 12:50
Static task
static1
Behavioral task
behavioral1
Sample
variableVar.jpg.dll
Resource
win7v20201028
0 signatures
0 seconds
General
-
Target
variableVar.jpg.dll
-
Size
563KB
-
MD5
3004a64ba549f0a7d15d394d1f3e955e
-
SHA1
a0e33fe6861a1afb2f201d6166a6e6e5414d9108
-
SHA256
4080ff8f402587476926487e628103c97d0519f65f4d3222b152507e60816059
-
SHA512
52d0be6e082f9449fb6f811c4e2edc1b034b0de5cd675c4a66f01fb6e4a7e024608f35bb80d36b5fa954da1c2d36f0a7015c258dc39f04d0fcad73a856771482
Malware Config
Extracted
Family
gozi_ifsb
Botnet
5500
C2
windows.update.com
shop.microsoft.com
fraloopilo.xyz
paladingrazz.xyz
Attributes
-
build
250177
-
dga_season
10
-
exe_type
loader
-
server_id
12
rsa_pubkey.base64
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2008 wrote to memory of 816 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 816 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 816 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 816 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 816 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 816 2008 regsvr32.exe regsvr32.exe PID 2008 wrote to memory of 816 2008 regsvr32.exe regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/816-3-0x0000000000000000-mapping.dmp
-
memory/816-4-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/816-5-0x0000000074D40000-0x0000000074D4F000-memory.dmpFilesize
60KB
-
memory/816-6-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2008-2-0x000007FEFC371000-0x000007FEFC373000-memory.dmpFilesize
8KB