Resubmissions
03/11/2021, 15:58
211103-tevassebf41002/11/2021, 04:23
211102-ez9hwsbfd61002/03/2021, 13:16
210302-qalv52kwwj10Analysis
- max time kernel
116s - max time network
123s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
03/11/2021, 15:58
General
- Target ewgr.png.dll
- Size 646KB
- Sample211103-tevassebf4
- SHA256 b4f98cb2d21258819d8678c29486a2e7854d576efc28b58d930551ca5aa24f20
Score
10/10
Malware Config
Extracted
Family
-
gozi_rm3
Attributes
-
build
300932
-
exe_type
loader
Extracted
Family
-
gozi_rm3
Botnet
-
201193209
C2
-
https://binobin.xyz
Attributes
-
build
300932
-
exe_type
loader
-
non_target_locale
RU
-
server_id
12
-
url_path
index.htm
rsa_pubkey.plain
serpent.plain
Signatures
- Gozi RM3
A heavily modified version of Gozi using RM3 loader.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ewgr.png.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ewgr.png.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 7443⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3184-116-0x0000000000BC0000-0x0000000000D0A000-memory.dmp
memory/3184-117-0x0000000004CF0000-0x0000000004D02000-memory.dmp
memory/3184-121-0x00000000048E0000-0x00000000048F0000-memory.dmp
memory/3184-120-0x00000000048C0000-0x00000000048CE000-memory.dmp