Analysis
-
max time kernel
123s -
max time network
125s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
25-05-2021 20:07
Static task
static1
Behavioral task
behavioral1
Sample
029e269d606b603b1d24064b85a21d69.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
029e269d606b603b1d24064b85a21d69.dll
-
Size
937KB
-
MD5
029e269d606b603b1d24064b85a21d69
-
SHA1
16a7179d17888438757fc2b013c1c9eb22d64e6c
-
SHA256
dac141db5d3b979ddf3490a47e333b3ec9b9112f5fb91d9442181db21599ff69
-
SHA512
89b027fc615782a284c53e9a7878104929476b977a862380d7c64b5060c77a4f203a5e6e10c52386d293b658cf850060c0aae3f2fcc7cc061e983470fbf4eaad
Malware Config
Extracted
Family
gozi_ifsb
Botnet
4500
C2
app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click
Attributes
-
build
250188
-
exe_type
loader
-
server_id
580
rsa_pubkey.base64
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1100 wrote to memory of 1932 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1932 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1932 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1932 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1932 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1932 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 1932 1100 rundll32.exe rundll32.exe PID 1932 wrote to memory of 1208 1932 rundll32.exe cmd.exe PID 1932 wrote to memory of 1208 1932 rundll32.exe cmd.exe PID 1932 wrote to memory of 1208 1932 rundll32.exe cmd.exe PID 1932 wrote to memory of 1208 1932 rundll32.exe cmd.exe PID 1932 wrote to memory of 2004 1932 rundll32.exe cmd.exe PID 1932 wrote to memory of 2004 1932 rundll32.exe cmd.exe PID 1932 wrote to memory of 2004 1932 rundll32.exe cmd.exe PID 1932 wrote to memory of 2004 1932 rundll32.exe cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\029e269d606b603b1d24064b85a21d69.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\029e269d606b603b1d24064b85a21d69.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Island3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Matter m3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-61-0x0000000000000000-mapping.dmp
-
memory/1932-59-0x0000000000000000-mapping.dmp
-
memory/1932-60-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/1932-63-0x0000000074AD0000-0x0000000074ADE000-memory.dmpFilesize
56KB
-
memory/1932-64-0x0000000074AD0000-0x0000000074BD4000-memory.dmpFilesize
1.0MB
-
memory/1932-65-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/2004-62-0x0000000000000000-mapping.dmp