Analysis
-
max time kernel
79s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09-05-2021 06:02
Static task
static1
Behavioral task
behavioral1
Sample
68fc6441db6c5539573adf08f210c39b.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
68fc6441db6c5539573adf08f210c39b.dll
-
Size
937KB
-
MD5
68fc6441db6c5539573adf08f210c39b
-
SHA1
c67a6a85716e0f1439cae1c1cdf259c271515e85
-
SHA256
802a752fca3ded051f0655c68012c769232d098d4a57c9887da39fa89070235a
-
SHA512
e20656f24256170306d05c8604d8d22989304327993d0180a9e9e1d8d699fa6ff66d835c1fa5e120e4bfbd6c802b59f142d53dbb6e86844808b1338b301d5316
Malware Config
Extracted
Family
gozi_ifsb
Botnet
4500
C2
app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click
Attributes
-
build
250188
-
exe_type
loader
-
server_id
580
rsa_pubkey.base64
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 484 wrote to memory of 1836 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 1836 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 1836 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 1836 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 1836 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 1836 484 rundll32.exe rundll32.exe PID 484 wrote to memory of 1836 484 rundll32.exe rundll32.exe PID 1836 wrote to memory of 2012 1836 rundll32.exe cmd.exe PID 1836 wrote to memory of 2012 1836 rundll32.exe cmd.exe PID 1836 wrote to memory of 2012 1836 rundll32.exe cmd.exe PID 1836 wrote to memory of 2012 1836 rundll32.exe cmd.exe PID 1836 wrote to memory of 1372 1836 rundll32.exe cmd.exe PID 1836 wrote to memory of 1372 1836 rundll32.exe cmd.exe PID 1836 wrote to memory of 1372 1836 rundll32.exe cmd.exe PID 1836 wrote to memory of 1372 1836 rundll32.exe cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68fc6441db6c5539573adf08f210c39b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68fc6441db6c5539573adf08f210c39b.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Island3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Matter m3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1372-62-0x0000000000000000-mapping.dmp
-
memory/1836-59-0x0000000000000000-mapping.dmp
-
memory/1836-60-0x0000000075AD1000-0x0000000075AD3000-memory.dmpFilesize
8KB
-
memory/1836-63-0x0000000074660000-0x000000007466E000-memory.dmpFilesize
56KB
-
memory/1836-65-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2012-61-0x0000000000000000-mapping.dmp