Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
26-10-2021 14:08
Static task
static1
Behavioral task
behavioral1
Sample
b76097aaa0ca490e5eb6b5a2dd13c5bc.dll
Resource
win7-en-20210920
General
-
Target
b76097aaa0ca490e5eb6b5a2dd13c5bc.dll
-
Size
549KB
-
MD5
b76097aaa0ca490e5eb6b5a2dd13c5bc
-
SHA1
9920ece38424d7902ffb7c28ae1b5c0d33e19aa8
-
SHA256
8f409a0d417462b342281b3f869a397ed4f5b8fd5841d140c8c57e7df39ff4b0
-
SHA512
16457a472ae064ccb3f8dc2e2d3231380c58c607f947a0570ac2a0cb54babbb27f542a778f367bcf81f15715da6378525b0e6e4fc10e2b571051a1bf8e3edb37
Malware Config
Extracted
gozi_ifsb
8899
http://microsoft.com.login/
https://premiumweare.com
https://gloverunomai.com
-
build
260212
-
dga_season
10
-
exe_type
loader
-
server_id
12
Signatures
-
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
-
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
-
Blocklisted process makes network request 13 IoCs
Processes:
rundll32.exeflow pid process 27 2708 rundll32.exe 28 2708 rundll32.exe 29 2708 rundll32.exe 31 2708 rundll32.exe 32 2708 rundll32.exe 33 2708 rundll32.exe 36 2708 rundll32.exe 37 2708 rundll32.exe 38 2708 rundll32.exe 39 2708 rundll32.exe 40 2708 rundll32.exe 42 2708 rundll32.exe 43 2708 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2680 wrote to memory of 2708 2680 rundll32.exe rundll32.exe PID 2680 wrote to memory of 2708 2680 rundll32.exe rundll32.exe PID 2680 wrote to memory of 2708 2680 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b76097aaa0ca490e5eb6b5a2dd13c5bc.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b76097aaa0ca490e5eb6b5a2dd13c5bc.dll,#12⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2708-115-0x0000000000000000-mapping.dmp
-
memory/2708-116-0x0000000074230000-0x00000000742CB000-memory.dmpFilesize
620KB
-
memory/2708-117-0x0000000074230000-0x000000007423F000-memory.dmpFilesize
60KB
-
memory/2708-118-0x0000000074230000-0x00000000742CB000-memory.dmpFilesize
620KB
-
memory/2708-119-0x0000000002DB0000-0x0000000002DB1000-memory.dmpFilesize
4KB