Analysis

  • max time kernel
    94s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    19/03/2022, 08:58

General

  • Target

    54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9.dll

  • Size

    456KB

  • MD5

    25a65068db29d21f15626ed5a89f0940

  • SHA1

    047f91c8f3cd95a0b5dbfc402607f73a96943730

  • SHA256

    54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9

  • SHA512

    1f06b0a9105821470d1ed7444ec769e2448f00d269adf4bc4942295787b154e0baee48f6a22e8687f4a06307e33c5829035558b4ea331b62a49d31400d47741e

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1100

C2

golang.feel500.at/api1

api10.laptok.at/api1

Attributes
  • build

    250171

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    730

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\54ea3470b7b6a4653c7253a874118971b842c3d38dcca7f65f3ec4446b63dff9.dll,#1
      2⤵
        PID:4304
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 620
          3⤵
          • Program crash
          PID:4860
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4304 -ip 4304
      1⤵
        PID:1276

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/4304-130-0x0000000002740000-0x000000000277D000-memory.dmp

              Filesize

              244KB

            • memory/4304-131-0x0000000000BE0000-0x0000000000BEF000-memory.dmp

              Filesize

              60KB