Analysis
-
max time kernel
62s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
10-06-2021 13:06
Static task
static1
Behavioral task
behavioral1
Sample
5a414b378a75f928594e1ddacccb40dc.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
5a414b378a75f928594e1ddacccb40dc.dll
-
Size
937KB
-
MD5
5a414b378a75f928594e1ddacccb40dc
-
SHA1
341a60d3181bf62aa8344f4544598f7e217c1b03
-
SHA256
0d4d60b0de26c90819f65b22796c1600e4942e95952c6cf19f2618b0461a441f
-
SHA512
bf2fceb2ac9c61f66203cf9001ee0bd3c0979469e537f3ed14c59492c588a9e818a6b5661c0e453d8f6f6597a48352abe985b5a84c8d9f50b2f23b1925205608
Malware Config
Extracted
Family
gozi_ifsb
Botnet
4500
C2
app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click
Attributes
-
build
250188
-
exe_type
loader
-
server_id
580
rsa_pubkey.base64
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 4008 wrote to memory of 1972 4008 rundll32.exe rundll32.exe PID 4008 wrote to memory of 1972 4008 rundll32.exe rundll32.exe PID 4008 wrote to memory of 1972 4008 rundll32.exe rundll32.exe PID 1972 wrote to memory of 1900 1972 rundll32.exe cmd.exe PID 1972 wrote to memory of 1900 1972 rundll32.exe cmd.exe PID 1972 wrote to memory of 1900 1972 rundll32.exe cmd.exe PID 1972 wrote to memory of 2504 1972 rundll32.exe cmd.exe PID 1972 wrote to memory of 2504 1972 rundll32.exe cmd.exe PID 1972 wrote to memory of 2504 1972 rundll32.exe cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a414b378a75f928594e1ddacccb40dc.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a414b378a75f928594e1ddacccb40dc.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Island3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Matter m3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1900-115-0x0000000000000000-mapping.dmp
-
memory/1972-114-0x0000000000000000-mapping.dmp
-
memory/1972-117-0x0000000073580000-0x000000007358E000-memory.dmpFilesize
56KB
-
memory/1972-118-0x0000000073580000-0x0000000073684000-memory.dmpFilesize
1.0MB
-
memory/1972-119-0x0000000000930000-0x0000000000A7A000-memory.dmpFilesize
1.3MB
-
memory/2504-116-0x0000000000000000-mapping.dmp