Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-05-2021 21:08
Static task
static1
Behavioral task
behavioral1
Sample
eaa396d7de6b9040a92c91f0ac5503ba.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
eaa396d7de6b9040a92c91f0ac5503ba.dll
-
Size
937KB
-
MD5
eaa396d7de6b9040a92c91f0ac5503ba
-
SHA1
a3c052e6d74cea274e739c42f6475cc80e880c0e
-
SHA256
dc0ae3accd7067b3b1b1c6c208a603b2a62ec9be53ad17ef5d4bf48528c00fe6
-
SHA512
169a0f2886034209fcc9b1f4cf41729d21c02613967edeb1dad11a1702f1ba4cc6b700e1e57f63f2bc2121e61b4454ddacd5a4f12fe0b42646177208210af9e8
Malware Config
Extracted
Family
gozi_ifsb
Botnet
4500
C2
app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click
Attributes
-
build
250188
-
exe_type
loader
-
server_id
580
rsa_pubkey.base64
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1440 wrote to memory of 1716 1440 rundll32.exe rundll32.exe PID 1440 wrote to memory of 1716 1440 rundll32.exe rundll32.exe PID 1440 wrote to memory of 1716 1440 rundll32.exe rundll32.exe PID 1716 wrote to memory of 1160 1716 rundll32.exe cmd.exe PID 1716 wrote to memory of 1160 1716 rundll32.exe cmd.exe PID 1716 wrote to memory of 1160 1716 rundll32.exe cmd.exe PID 1716 wrote to memory of 200 1716 rundll32.exe cmd.exe PID 1716 wrote to memory of 200 1716 rundll32.exe cmd.exe PID 1716 wrote to memory of 200 1716 rundll32.exe cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eaa396d7de6b9040a92c91f0ac5503ba.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eaa396d7de6b9040a92c91f0ac5503ba.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Island3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Matter m3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/200-116-0x0000000000000000-mapping.dmp
-
memory/1160-115-0x0000000000000000-mapping.dmp
-
memory/1716-114-0x0000000000000000-mapping.dmp
-
memory/1716-118-0x00000000738B0000-0x00000000739B4000-memory.dmpFilesize
1.0MB
-
memory/1716-117-0x00000000738B0000-0x00000000738BE000-memory.dmpFilesize
56KB
-
memory/1716-119-0x0000000002250000-0x000000000239A000-memory.dmpFilesize
1.3MB