Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
06/02/2022, 21:46
Static task
static1
Behavioral task
behavioral1
Sample
gunky.odp
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
gunky.odp
Resource
win10v2004-en-20220113
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
trainmen.dll
Resource
win7-en-20211208
0 signatures
0 seconds
General
-
Target
trainmen.dll
-
Size
160KB
-
MD5
24433fe5aed50417b17663e46bacf92c
-
SHA1
6ff9b5c8ff0fc10f3bcce07c4f4fda2eaa351188
-
SHA256
263be47f602b2156c9282afdd6a0f1fe9bb9022cef2eb0a821e8d8153d3a8d06
-
SHA512
c833a0e82e83e663eb362e7c18ae737d5750df2f1ad55ba68ba33ab87ed3d181b30bc8672f0a58e60ea25c0067b548e11d90cd8c8b4f566450fec01712900720
Malware Config
Extracted
Family
gozi_ifsb
Botnet
2200
C2
api10.laptok.at/api1
golang.feel500.at/api1
go.in100k.at/api1
Attributes
-
build
250180
-
exe_type
loader
-
server_id
730
rsa_pubkey.plain
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 852 wrote to memory of 1252 852 regsvr32.exe 27 PID 852 wrote to memory of 1252 852 regsvr32.exe 27 PID 852 wrote to memory of 1252 852 regsvr32.exe 27 PID 852 wrote to memory of 1252 852 regsvr32.exe 27 PID 852 wrote to memory of 1252 852 regsvr32.exe 27 PID 852 wrote to memory of 1252 852 regsvr32.exe 27 PID 852 wrote to memory of 1252 852 regsvr32.exe 27