Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
30-11-2021 12:20
Static task
static1
Behavioral task
behavioral1
Sample
6.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
6.dll
-
Size
138KB
-
MD5
e7b4153cc22f46f87835b6d59d6905e4
-
SHA1
ca6f9879c802bf96697354b01c61e5a98b769275
-
SHA256
67eaada8a12b536d407706e21e7f5b38ccc29d62e40dd66bbf2b2902df0169f0
-
SHA512
e8e6de8e3ccdd5de96747938fea18294c428794a11e77b96a494be1e54c2641f26a995733e6e307eece9c7635c7b70a329527d01a86134ac1095b696c8a19012
Malware Config
Extracted
Family
gozi_ifsb
Botnet
8899
C2
microsoft.com/windowsdisabler
bvolebukoneh.site
karfaganda.com
Attributes
-
build
260216
-
dga_season
10
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 952 wrote to memory of 1076 952 regsvr32.exe regsvr32.exe PID 952 wrote to memory of 1076 952 regsvr32.exe regsvr32.exe PID 952 wrote to memory of 1076 952 regsvr32.exe regsvr32.exe PID 952 wrote to memory of 1076 952 regsvr32.exe regsvr32.exe PID 952 wrote to memory of 1076 952 regsvr32.exe regsvr32.exe PID 952 wrote to memory of 1076 952 regsvr32.exe regsvr32.exe PID 952 wrote to memory of 1076 952 regsvr32.exe regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-55-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmpFilesize
8KB
-
memory/1076-56-0x0000000000000000-mapping.dmp
-
memory/1076-57-0x0000000076431000-0x0000000076433000-memory.dmpFilesize
8KB
-
memory/1076-58-0x00000000000F0000-0x00000000000FF000-memory.dmpFilesize
60KB