Analysis
-
max time kernel
130s -
max time network
133s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
09-05-2021 06:02
Static task
static1
Behavioral task
behavioral1
Sample
68fc6441db6c5539573adf08f210c39b.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
68fc6441db6c5539573adf08f210c39b.dll
-
Size
937KB
-
MD5
68fc6441db6c5539573adf08f210c39b
-
SHA1
c67a6a85716e0f1439cae1c1cdf259c271515e85
-
SHA256
802a752fca3ded051f0655c68012c769232d098d4a57c9887da39fa89070235a
-
SHA512
e20656f24256170306d05c8604d8d22989304327993d0180a9e9e1d8d699fa6ff66d835c1fa5e120e4bfbd6c802b59f142d53dbb6e86844808b1338b301d5316
Malware Config
Extracted
Family
gozi_ifsb
Botnet
4500
C2
app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click
Attributes
-
build
250188
-
exe_type
loader
-
server_id
580
rsa_pubkey.base64
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2232 wrote to memory of 1920 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 1920 2232 rundll32.exe rundll32.exe PID 2232 wrote to memory of 1920 2232 rundll32.exe rundll32.exe PID 1920 wrote to memory of 1504 1920 rundll32.exe cmd.exe PID 1920 wrote to memory of 1504 1920 rundll32.exe cmd.exe PID 1920 wrote to memory of 1504 1920 rundll32.exe cmd.exe PID 1920 wrote to memory of 2500 1920 rundll32.exe cmd.exe PID 1920 wrote to memory of 2500 1920 rundll32.exe cmd.exe PID 1920 wrote to memory of 2500 1920 rundll32.exe cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68fc6441db6c5539573adf08f210c39b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68fc6441db6c5539573adf08f210c39b.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Island3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Matter m3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1504-115-0x0000000000000000-mapping.dmp
-
memory/1920-114-0x0000000000000000-mapping.dmp
-
memory/1920-117-0x0000000073580000-0x000000007358E000-memory.dmpFilesize
56KB
-
memory/1920-118-0x0000000073580000-0x0000000073684000-memory.dmpFilesize
1.0MB
-
memory/1920-119-0x0000000002E40000-0x0000000002EEE000-memory.dmpFilesize
696KB
-
memory/2500-116-0x0000000000000000-mapping.dmp