Analysis

  • max time kernel
    4294181s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    19/03/2022, 08:58

General

  • Target

    54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9.dll

  • Size

    456KB

  • MD5

    25a65068db29d21f15626ed5a89f0940

  • SHA1

    047f91c8f3cd95a0b5dbfc402607f73a96943730

  • SHA256

    54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9

  • SHA512

    1f06b0a9105821470d1ed7444ec769e2448f00d269adf4bc4942295787b154e0baee48f6a22e8687f4a06307e33c5829035558b4ea331b62a49d31400d47741e

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1100

C2

golang.feel500.at/api1

api10.laptok.at/api1

Attributes
  • build

    250171

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    730

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:572
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9.dll,#1
      2⤵
        PID:596

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/596-54-0x0000000075561000-0x0000000075563000-memory.dmp

            Filesize

            8KB

          • memory/596-56-0x0000000000130000-0x000000000013F000-memory.dmp

            Filesize

            60KB

          • memory/596-55-0x0000000000130000-0x000000000013F000-memory.dmp

            Filesize

            60KB

          • memory/596-57-0x0000000000190000-0x00000000001CD000-memory.dmp

            Filesize

            244KB

          • memory/596-58-0x0000000000130000-0x000000000013F000-memory.dmp

            Filesize

            60KB