Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
25-10-2021 10:15
Static task
static1
Behavioral task
behavioral1
Sample
617683636aa85.tiff.dll
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
617683636aa85.tiff.dll
-
Size
942KB
-
MD5
63bf1fa8174987625e5e43cb0ed13e82
-
SHA1
644b87f4721c0b9b5409d19717dffea20b788081
-
SHA256
42b7c2ea97c98f21d2a5fb271364530115369f9bb08ef03fa57013cc036b6f00
-
SHA512
1ddd98f42cb271bd55f96a2291951ec761f81b8958269e67166c74ff40c3ce65a96c0011c4a024a6b1c54709043ab8cba4b22ddefa435b20696556057c2737f8
Malware Config
Extracted
Family
gozi_ifsb
Botnet
8899
C2
msn.com/mail
realitystorys.com
outlook.com/signup
gderrrpololo.net
Attributes
-
build
260212
-
dga_season
10
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 836 wrote to memory of 1724 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1724 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1724 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1724 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1724 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1724 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1724 836 rundll32.exe rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1724-54-0x0000000000000000-mapping.dmp
-
memory/1724-55-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/1724-56-0x0000000074C70000-0x0000000074D74000-memory.dmpFilesize
1.0MB
-
memory/1724-58-0x0000000074C70000-0x0000000074D74000-memory.dmpFilesize
1.0MB
-
memory/1724-57-0x0000000074C70000-0x0000000074C7F000-memory.dmpFilesize
60KB
-
memory/1724-59-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB