Analysis
-
max time kernel
65s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-07-2021 15:07
Static task
static1
Behavioral task
behavioral1
Sample
c4b2f757b08982fac75a63df8a5569e09b320a22d0f202681d55cc968c01f71b.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
c4b2f757b08982fac75a63df8a5569e09b320a22d0f202681d55cc968c01f71b.dll
-
Size
937KB
-
MD5
1da0601d46dd56e2cfff320376dcf6d9
-
SHA1
2c8f22a48e97a9284452ef9b46b5f4bfe38e3199
-
SHA256
c4b2f757b08982fac75a63df8a5569e09b320a22d0f202681d55cc968c01f71b
-
SHA512
7c1f8d3e2b061f9a202a84ad7e2389afea636f745c38b62bc40c72431ed493b0242a2362ef02b98f5fd8dfd552c386392391e1cf4450a9c41c72c1316f3f0e5e
Malware Config
Extracted
Family
gozi_ifsb
Botnet
4500
C2
app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click
Attributes
-
build
250188
-
exe_type
loader
-
server_id
580
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 396 wrote to memory of 1320 396 rundll32.exe rundll32.exe PID 396 wrote to memory of 1320 396 rundll32.exe rundll32.exe PID 396 wrote to memory of 1320 396 rundll32.exe rundll32.exe PID 1320 wrote to memory of 3916 1320 rundll32.exe cmd.exe PID 1320 wrote to memory of 3916 1320 rundll32.exe cmd.exe PID 1320 wrote to memory of 3916 1320 rundll32.exe cmd.exe PID 1320 wrote to memory of 2856 1320 rundll32.exe cmd.exe PID 1320 wrote to memory of 2856 1320 rundll32.exe cmd.exe PID 1320 wrote to memory of 2856 1320 rundll32.exe cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4b2f757b08982fac75a63df8a5569e09b320a22d0f202681d55cc968c01f71b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4b2f757b08982fac75a63df8a5569e09b320a22d0f202681d55cc968c01f71b.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Island3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Matter m3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1320-114-0x0000000000000000-mapping.dmp
-
memory/1320-117-0x0000000073B90000-0x0000000073B9E000-memory.dmpFilesize
56KB
-
memory/1320-118-0x0000000073B90000-0x0000000073C94000-memory.dmpFilesize
1.0MB
-
memory/1320-119-0x0000000003050000-0x00000000030FE000-memory.dmpFilesize
696KB
-
memory/2856-116-0x0000000000000000-mapping.dmp
-
memory/3916-115-0x0000000000000000-mapping.dmp