Analysis
- max time kernel
144s - max time network
136s - submitted
01/01/1970, 00:00
General
- Target c3a4ce9f2dd1721a3a25db6cbc0b5dd6.dll
- Size 467KB
- Sample211027-nvlqpsefb2
- SHA256 2eeee8a83dcf0cbfff2dccaf4408c7ac17130d2ee06d31698d2b58e97e280f75
Score
10/10
Malware Config
Extracted
Family
-
gozi_ifsb
Botnet
-
8899
C2
-
msn.com/mail
-
realitystorys.com
-
outlook.com/signup
-
gderrrpololo.net
Attributes
-
build
260212
-
dga_season
10
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
- Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3a4ce9f2dd1721a3a25db6cbc0b5dd6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3a4ce9f2dd1721a3a25db6cbc0b5dd6.dll,#12⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1008-116-0x0000000074390000-0x0000000074415000-memory.dmp
memory/1008-118-0x0000000074390000-0x0000000074415000-memory.dmp
memory/1008-117-0x0000000074390000-0x000000007439F000-memory.dmp
memory/1008-119-0x0000000000490000-0x0000000000491000-memory.dmp