Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-05-2021 07:06
Static task
static1
Behavioral task
behavioral1
Sample
526b7faa3b330ec7390cfd501504e7ec.dll
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
526b7faa3b330ec7390cfd501504e7ec.dll
-
Size
937KB
-
MD5
526b7faa3b330ec7390cfd501504e7ec
-
SHA1
864503c8df4e15c76cab6441ebe3ecee721ab0be
-
SHA256
0ec847dec15446cec4d80a76bd4eb7ea49033ae5dfc05a19500dae395e0e93fd
-
SHA512
7a093fbda59dd25eba951115d95a8328fe68aa6c647eb4ed7a054f76322783eb2c86cfaf1071ebe308e8aee39a4aded454b2ef4c5dbd0263723213347c8e485d
Malware Config
Extracted
Family
gozi_ifsb
Botnet
4500
C2
app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click
Attributes
-
build
250188
-
exe_type
loader
-
server_id
580
rsa_pubkey.base64
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 4432 wrote to memory of 4520 4432 rundll32.exe rundll32.exe PID 4432 wrote to memory of 4520 4432 rundll32.exe rundll32.exe PID 4432 wrote to memory of 4520 4432 rundll32.exe rundll32.exe PID 4520 wrote to memory of 4856 4520 rundll32.exe cmd.exe PID 4520 wrote to memory of 4856 4520 rundll32.exe cmd.exe PID 4520 wrote to memory of 4856 4520 rundll32.exe cmd.exe PID 4520 wrote to memory of 5008 4520 rundll32.exe cmd.exe PID 4520 wrote to memory of 5008 4520 rundll32.exe cmd.exe PID 4520 wrote to memory of 5008 4520 rundll32.exe cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\526b7faa3b330ec7390cfd501504e7ec.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\526b7faa3b330ec7390cfd501504e7ec.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Island3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Matter m3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4520-114-0x0000000000000000-mapping.dmp
-
memory/4520-118-0x00000000741B0000-0x00000000742B4000-memory.dmpFilesize
1.0MB
-
memory/4520-117-0x00000000741B0000-0x00000000741BE000-memory.dmpFilesize
56KB
-
memory/4520-119-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/4856-115-0x0000000000000000-mapping.dmp
-
memory/5008-116-0x0000000000000000-mapping.dmp