Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
18-06-2021 15:25
Static task
static1
Behavioral task
behavioral1
Sample
mazu8.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
mazu8.dll
-
Size
492KB
-
MD5
86c8dfad40c3433eb50b0cc476709c16
-
SHA1
5c8801339c173af1a1f886d93be9f14b7bc9221b
-
SHA256
a0bd4ce77bdb2eb80482cea76fd3d3af8eb6ed9ee5a4e1388e3ba90768ec7848
-
SHA512
56c3b727309f2ae6c636933d78b7f5db503b1ef57ef24ff71b347698c4e5c282d4cb4011e93c5a096105ec83845bb1ff44a89a33d8bec1701b3425ad59ea848b
Malware Config
Extracted
Family
gozi_ifsb
Botnet
6000
C2
authd.feronok.com
app.bighomegl.at
Attributes
-
build
250204
-
exe_type
loader
-
server_id
580
rsa_pubkey.base64
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1096 wrote to memory of 1988 1096 rundll32.exe rundll32.exe PID 1096 wrote to memory of 1988 1096 rundll32.exe rundll32.exe PID 1096 wrote to memory of 1988 1096 rundll32.exe rundll32.exe PID 1096 wrote to memory of 1988 1096 rundll32.exe rundll32.exe PID 1096 wrote to memory of 1988 1096 rundll32.exe rundll32.exe PID 1096 wrote to memory of 1988 1096 rundll32.exe rundll32.exe PID 1096 wrote to memory of 1988 1096 rundll32.exe rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1988-59-0x0000000000000000-mapping.dmp
-
memory/1988-60-0x0000000075281000-0x0000000075283000-memory.dmpFilesize
8KB
-
memory/1988-61-0x00000000006F0000-0x0000000000780000-memory.dmpFilesize
576KB
-
memory/1988-62-0x00000000006F0000-0x00000000006FD000-memory.dmpFilesize
52KB
-
memory/1988-63-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB