Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-05-2021 06:39
Static task
static1
Behavioral task
behavioral1
Sample
526b7faa3b330ec7390cfd501504e7ec.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
526b7faa3b330ec7390cfd501504e7ec.dll
-
Size
937KB
-
MD5
526b7faa3b330ec7390cfd501504e7ec
-
SHA1
864503c8df4e15c76cab6441ebe3ecee721ab0be
-
SHA256
0ec847dec15446cec4d80a76bd4eb7ea49033ae5dfc05a19500dae395e0e93fd
-
SHA512
7a093fbda59dd25eba951115d95a8328fe68aa6c647eb4ed7a054f76322783eb2c86cfaf1071ebe308e8aee39a4aded454b2ef4c5dbd0263723213347c8e485d
Malware Config
Extracted
Family
gozi_ifsb
Botnet
4500
C2
app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click
Attributes
-
build
250188
-
exe_type
loader
-
server_id
580
rsa_pubkey.base64
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2116 wrote to memory of 2556 2116 rundll32.exe rundll32.exe PID 2116 wrote to memory of 2556 2116 rundll32.exe rundll32.exe PID 2116 wrote to memory of 2556 2116 rundll32.exe rundll32.exe PID 2556 wrote to memory of 1220 2556 rundll32.exe cmd.exe PID 2556 wrote to memory of 1220 2556 rundll32.exe cmd.exe PID 2556 wrote to memory of 1220 2556 rundll32.exe cmd.exe PID 2556 wrote to memory of 1888 2556 rundll32.exe cmd.exe PID 2556 wrote to memory of 1888 2556 rundll32.exe cmd.exe PID 2556 wrote to memory of 1888 2556 rundll32.exe cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\526b7faa3b330ec7390cfd501504e7ec.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\526b7faa3b330ec7390cfd501504e7ec.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Island3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Matter m3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1220-115-0x0000000000000000-mapping.dmp
-
memory/1888-116-0x0000000000000000-mapping.dmp
-
memory/2556-114-0x0000000000000000-mapping.dmp
-
memory/2556-118-0x0000000074340000-0x0000000074444000-memory.dmpFilesize
1.0MB
-
memory/2556-117-0x0000000074340000-0x000000007434E000-memory.dmpFilesize
56KB
-
memory/2556-119-0x0000000002E30000-0x0000000002E31000-memory.dmpFilesize
4KB