Analysis

  • max time kernel
    4294180s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    22/03/2022, 11:32

General

  • Target

    readme2.dll

  • Size

    654KB

  • MD5

    f762a352d68d6a4b5de6e1dfb97f695c

  • SHA1

    ae71e05af13607ec1339bb4e5c3dff70b93b822d

  • SHA256

    d6bbd7322d650172dc416d232a8965a35d18051d29634116df4f8cb175dd660d

  • SHA512

    d3129b92317e2bde49da4a191d079c657eabd6051fc55b28bf782a96aa65bd1dea17a40999c9931b5e5e62db6e9016afb4e1b2a0bda06455c0054d2b59541eb2

Malware Config

Extracted

Family

gozi_ifsb

Botnet

7626

C2

buredom.top

linkspremium.ru

premiumlists.ru

Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\readme2.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\readme2.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1620
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 224
        3⤵
        • Program crash
        PID:1628

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1620-54-0x00000000755A1000-0x00000000755A3000-memory.dmp

          Filesize

          8KB

        • memory/1620-55-0x0000000000740000-0x00000000007E8000-memory.dmp

          Filesize

          672KB

        • memory/1620-57-0x00000000001F0000-0x00000000001FE000-memory.dmp

          Filesize

          56KB

        • memory/1620-56-0x00000000001F0000-0x00000000001FE000-memory.dmp

          Filesize

          56KB

        • memory/1620-59-0x00000000001F0000-0x00000000001FE000-memory.dmp

          Filesize

          56KB

        • memory/1620-60-0x00000000001C0000-0x00000000001CC000-memory.dmp

          Filesize

          48KB