Resubmissions

06-12-2021 10:53

211206-my8tzagfh4 10

28-07-2021 08:22

210728-8lskcpfdj6 10

Analysis

  • max time kernel
    34s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    28-07-2021 08:22

General

  • Target

    6101135878f66.dll

  • Size

    543KB

  • MD5

    0d68d238d713f63ff02be916ae633466

  • SHA1

    46958a4143c337f8406b0c785d434c8892e902e8

  • SHA256

    9c4088dfc53bb7b6d9887d200801a926b73c09458910460a2d6f4e2d67f13e6e

  • SHA512

    502daafc9ba908cf8b682e2496be0785c7ccf035e8876df2b31b97dd43a5f79e50505afa63cd60be1df89003ae774d071777433cfc2b14359e581175b290ef33

Malware Config

Extracted

Family

gozi_ifsb

Botnet

8877

C2

outlook.com

zaluoa.live

daskdjknefjkewfnkjwe.net

Attributes
  • build

    250207

  • dga_season

    10

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6101135878f66.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\6101135878f66.dll,#1
      2⤵
        PID:780

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/780-114-0x0000000000000000-mapping.dmp
    • memory/780-116-0x00000000735B0000-0x00000000736D4000-memory.dmp
      Filesize

      1.1MB

    • memory/780-115-0x00000000735B0000-0x00000000735BF000-memory.dmp
      Filesize

      60KB

    • memory/780-117-0x00000000027F0000-0x00000000027F1000-memory.dmp
      Filesize

      4KB