Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
08/02/2022, 13:24
Static task
static1
Behavioral task
behavioral1
Sample
image.dll
Resource
win7-en-20211208
0 signatures
0 seconds
General
-
Target
image.dll
-
Size
503KB
-
MD5
99eb077df2ad3f8678d7d80e0b240682
-
SHA1
302f8aa0b2c284634a06098c9a8f0a81ea10e402
-
SHA256
2603f6890e3c3d47696b37c47516ac2e9f35e6805653f467a0a22de2b88defc8
-
SHA512
8f704e48c2461440562ccb22af6ce4e812bc3be5bfbf16b35d0b024af317b38f083d3f78d9d117197f23f19e4168ec1ca856271da8d986a6e2d2c22d1dcf4483
Malware Config
Extracted
Family
gozi_ifsb
Botnet
7611
C2
premiumliner.top
premiumline.space
linkspremium.ru
premiumlists.ru
Attributes
-
base_path
/drew/
-
build
250225
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1580 wrote to memory of 1768 1580 regsvr32.exe 27 PID 1580 wrote to memory of 1768 1580 regsvr32.exe 27 PID 1580 wrote to memory of 1768 1580 regsvr32.exe 27 PID 1580 wrote to memory of 1768 1580 regsvr32.exe 27 PID 1580 wrote to memory of 1768 1580 regsvr32.exe 27 PID 1580 wrote to memory of 1768 1580 regsvr32.exe 27 PID 1580 wrote to memory of 1768 1580 regsvr32.exe 27