Analysis
-
max time kernel
61s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-05-2021 17:58
Static task
static1
Behavioral task
behavioral1
Sample
e0ebdc2043f61719c22ab6de883ff842.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
e0ebdc2043f61719c22ab6de883ff842.dll
-
Size
937KB
-
MD5
e0ebdc2043f61719c22ab6de883ff842
-
SHA1
7b42580d8cccb48996b2181d80c52971036221fa
-
SHA256
98c29d3c1c76a00271ba5f2cf65106eb0870cf466e57954726143e293134971e
-
SHA512
a922ff41fef15f2a2c1e6c84b055cacca7624a29146f324384cbc9cf7aa828d64b015ffc808659b1962202cdd6193e7499166d0a7e99af904787c0a2fb65a38d
Malware Config
Extracted
Family
gozi_ifsb
Botnet
4500
C2
app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click
Attributes
-
build
250188
-
exe_type
loader
-
server_id
580
rsa_pubkey.base64
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3016 wrote to memory of 3908 3016 rundll32.exe rundll32.exe PID 3016 wrote to memory of 3908 3016 rundll32.exe rundll32.exe PID 3016 wrote to memory of 3908 3016 rundll32.exe rundll32.exe PID 3908 wrote to memory of 364 3908 rundll32.exe cmd.exe PID 3908 wrote to memory of 364 3908 rundll32.exe cmd.exe PID 3908 wrote to memory of 364 3908 rundll32.exe cmd.exe PID 3908 wrote to memory of 2096 3908 rundll32.exe cmd.exe PID 3908 wrote to memory of 2096 3908 rundll32.exe cmd.exe PID 3908 wrote to memory of 2096 3908 rundll32.exe cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e0ebdc2043f61719c22ab6de883ff842.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e0ebdc2043f61719c22ab6de883ff842.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Island3⤵PID:364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Matter m3⤵PID:2096
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/364-115-0x0000000000000000-mapping.dmp
-
memory/2096-116-0x0000000000000000-mapping.dmp
-
memory/3908-114-0x0000000000000000-mapping.dmp
-
memory/3908-117-0x00000000739C0000-0x00000000739CE000-memory.dmpFilesize
56KB
-
memory/3908-118-0x00000000739C0000-0x0000000073AC4000-memory.dmpFilesize
1.0MB
-
memory/3908-119-0x0000000000920000-0x0000000000A6A000-memory.dmpFilesize
1.3MB