Analysis
-
max time kernel
123s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
11-10-2021 14:22
Static task
static1
Behavioral task
behavioral1
Sample
5aa733e108f0fa41df88cea0a309affe.dll
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
5aa733e108f0fa41df88cea0a309affe.dll
-
Size
701KB
-
MD5
5aa733e108f0fa41df88cea0a309affe
-
SHA1
ce79918ca7845f2163360ea40a251912998ea226
-
SHA256
1be687a0453f23ea53b94a4447c926a9b4b6e01c2788e641b76eb4a5215bd960
-
SHA512
e18ef98a6bb007ee0ef473cd05bad85ac2f177d316981658e17a12f182effbcc98754fbefc362a4212a8eebcc71fc2e2a15c865b08c50f5990223bcb55d001af
Malware Config
Extracted
Family
gozi_ifsb
Botnet
8899
C2
msn.com/mail
breuranel.website
outlook.com/signup
areuranel.website
Attributes
-
build
260212
-
dga_season
10
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1652 wrote to memory of 1700 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 1700 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 1700 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 1700 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 1700 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 1700 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 1700 1652 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa733e108f0fa41df88cea0a309affe.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa733e108f0fa41df88cea0a309affe.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1700-54-0x0000000000000000-mapping.dmp
-
memory/1700-55-0x0000000074C71000-0x0000000074C73000-memory.dmpFilesize
8KB
-
memory/1700-56-0x00000000744F0000-0x000000007463C000-memory.dmpFilesize
1.3MB
-
memory/1700-57-0x00000000744F0000-0x00000000744FF000-memory.dmpFilesize
60KB
-
memory/1700-58-0x00000000744F0000-0x000000007463C000-memory.dmpFilesize
1.3MB
-
memory/1700-59-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB