Analysis
-
max time kernel
104s -
max time network
18s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
12-05-2021 00:33
Static task
static1
Behavioral task
behavioral1
Sample
e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0.dll
-
Size
821KB
-
MD5
1752fe2b8419be8241ecd08859a5800f
-
SHA1
eb7346a6d5a53ddaf8fd073f266c64d642b40a7d
-
SHA256
e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0
-
SHA512
0718e566bdec828d59890818a65af53f467d1bab92abbdd2ecfe3eca55be7ad3692793e4310ea41f2ab2a9f5e9fe6d29e1873cacc1614c6f2cceaf6b320c8f15
Malware Config
Extracted
Family
gozi_ifsb
Botnet
8877
C2
outlook.com/login
gmail.com
worunekulo.club
horunekulo.website
Attributes
-
build
250196
-
dga_season
10
-
exe_type
loader
-
server_id
12
rsa_pubkey.base64
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1304 wrote to memory of 1840 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1840 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1840 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1840 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1840 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1840 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1840 1304 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e81869620b9a18c3702c7be2fcf2e170cbc5c3de1ddbc84ae1fe190b57e917a0.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1840-60-0x0000000000000000-mapping.dmp
-
memory/1840-61-0x0000000075AD1000-0x0000000075AD3000-memory.dmpFilesize
8KB
-
memory/1840-62-0x0000000074590000-0x000000007459F000-memory.dmpFilesize
60KB
-
memory/1840-63-0x0000000074590000-0x000000007467F000-memory.dmpFilesize
956KB
-
memory/1840-64-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB