Analysis

  • max time kernel
    13s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    10-06-2021 19:02

General

  • Target

    xadar2.dll

  • Size

    599KB

  • MD5

    19baa9539543713cae4729f6e8b391a4

  • SHA1

    3b0e1f27ea4987c1351f7a3c2bfef42bca29968a

  • SHA256

    7a37e6d1d52cc4dc8a62bc34bdf3d6af44685ef6ea57bbf7c37cc724b4453d57

  • SHA512

    1395689dee159553a52d1858eb0f71295163ef24c1c926b2a24c22afb853a08efe5f3d21cae79dfb95147261ac3dc470096f9c99190dce634aa4891e655a1910

Malware Config

Extracted

Family

gozi_ifsb

Botnet

6000

C2

authd.feronok.com

app.bighomegl.at

Attributes
  • build

    250204

  • exe_type

    loader

  • server_id

    580

rsa_pubkey.base64
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\xadar2.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\xadar2.dll,#1
      2⤵
        PID:3228

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3228-114-0x0000000000000000-mapping.dmp
    • memory/3228-115-0x0000000073AC0000-0x0000000073ACD000-memory.dmp
      Filesize

      52KB

    • memory/3228-116-0x0000000073AC0000-0x0000000073BA9000-memory.dmp
      Filesize

      932KB

    • memory/3228-117-0x0000000003350000-0x000000000349A000-memory.dmp
      Filesize

      1.3MB