Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
30-11-2021 13:51
Static task
static1
Behavioral task
behavioral1
Sample
385380c7409a78c5ae02d4aa951e5985.dll
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
General
-
Target
385380c7409a78c5ae02d4aa951e5985.dll
-
Size
138KB
-
MD5
385380c7409a78c5ae02d4aa951e5985
-
SHA1
482048fa246855da06851da7922a9e7af53bd7e8
-
SHA256
89c96abd438fcd8617a3ea527c5162a5111856568cfd6b73b970aad1eefcde1a
-
SHA512
6d72f3b0df485de3170a78b77387e032d67d66570ccbc3d31d6cd1c763563c33cfe54fc5884d44685971abc4c8f64e411534afbb0ad0bf59c4d7800564e4f328
Malware Config
Extracted
Family
gozi_ifsb
Botnet
8899
C2
microsoft.com/windowsdisabler
bvolebukoneh.site
karfaganda.com
Attributes
-
build
260216
-
dga_season
10
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 676 wrote to memory of 472 676 regsvr32.exe regsvr32.exe PID 676 wrote to memory of 472 676 regsvr32.exe regsvr32.exe PID 676 wrote to memory of 472 676 regsvr32.exe regsvr32.exe PID 676 wrote to memory of 472 676 regsvr32.exe regsvr32.exe PID 676 wrote to memory of 472 676 regsvr32.exe regsvr32.exe PID 676 wrote to memory of 472 676 regsvr32.exe regsvr32.exe PID 676 wrote to memory of 472 676 regsvr32.exe regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/472-56-0x0000000000000000-mapping.dmp
-
memory/472-57-0x0000000075AB1000-0x0000000075AB3000-memory.dmpFilesize
8KB
-
memory/472-58-0x0000000000210000-0x000000000021F000-memory.dmpFilesize
60KB
-
memory/676-55-0x000007FEFC5C1000-0x000007FEFC5C3000-memory.dmpFilesize
8KB