Analysis

  • max time kernel
    4294183s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    22/03/2022, 14:52

General

  • Target

    readme.dll

  • Size

    654KB

  • MD5

    5cc6ba143e3c3ad5ba978148d213e1ac

  • SHA1

    39d67ee1af666dd307049ac017bde0c75f9d120c

  • SHA256

    64eb761e7ec0ccfd080a70bd1c6a34de92a5e9aea591793ae08155a211ad3726

  • SHA512

    6742c064f7178be86e1d5e157d987445fbaa259c88043f4179f35d8ecba8d2d17765d9856985dfb6034bde4b0a3dbea1905d3be51587b974206fa6eaf6ddc38a

Malware Config

Extracted

Family

gozi_ifsb

Botnet

7626

C2

buredom.top

linkspremium.ru

premiumlists.ru

Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\readme.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1604
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\readme.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 224
        3⤵
        • Program crash
        PID:1660

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1652-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

          Filesize

          8KB

        • memory/1652-56-0x0000000000160000-0x000000000016E000-memory.dmp

          Filesize

          56KB

        • memory/1652-55-0x0000000000160000-0x000000000016E000-memory.dmp

          Filesize

          56KB

        • memory/1652-58-0x0000000000160000-0x000000000016E000-memory.dmp

          Filesize

          56KB

        • memory/1652-59-0x0000000000140000-0x000000000014C000-memory.dmp

          Filesize

          48KB