Analysis
- max time kernel
43s - max time network
122s - platform
windows10_x64 - resource
win10v20210408 - submitted
13/07/2021, 08:21
General
- Target 60ed4ca406c9c.dll
- Size 464KB
- Sample210713-levy8ccgre
- SHA256 54ce5aedb7cc073c481eb8af96f89f3ab11e5decaccf942d033479fd0f04c8b3
Score
10/10
Malware Config
Extracted
Family
-
gozi_ifsb
Botnet
-
8877
C2
-
outlook.com
-
dronmakerparallel.email
-
moonlightparallels.email
Attributes
-
build
250207
-
dga_season
10
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
- Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\60ed4ca406c9c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\60ed4ca406c9c.dll,#12⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3888-115-0x0000000004560000-0x0000000004673000-memory.dmp
memory/3888-116-0x0000000004560000-0x000000000456F000-memory.dmp
memory/3888-117-0x0000000004561000-0x00000000045AB000-memory.dmp
memory/3888-118-0x0000000002CC0000-0x0000000002CC1000-memory.dmp