Analysis
- max time kernel
136s - max time network
150s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
18/10/2021, 08:45
General
- Target 616d32105a9b7.tiff.dll
- Size 606KB
- Sample211018-knrftsdcd7
- SHA256 210943dc00e09514fe7d9a433596e78a21d7eb3bf3537b7e8327b985c8ad7d4d
Score
10/10
Malware Config
Extracted
Family
-
gozi_ifsb
Botnet
-
5566
C2
-
outlook.com
-
peajame.com
-
gderrrpololo.net
Attributes
-
build
250211
-
dga_season
10
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
- Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
- Blocklisted process makes network request 5 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\616d32105a9b7.tiff.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\616d32105a9b7.tiff.dll,#12⤵
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3784-116-0x0000000073DC0000-0x0000000073EFB000-memory.dmp
memory/3784-118-0x0000000073DC0000-0x0000000073EFB000-memory.dmp
memory/3784-117-0x0000000073DC0000-0x0000000073DCF000-memory.dmp
memory/3784-119-0x0000000004CE0000-0x0000000004D03000-memory.dmp