Analysis

  • max time kernel
    138s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    22/03/2022, 14:52

General

  • Target

    readme.dll

  • Size

    654KB

  • MD5

    5cc6ba143e3c3ad5ba978148d213e1ac

  • SHA1

    39d67ee1af666dd307049ac017bde0c75f9d120c

  • SHA256

    64eb761e7ec0ccfd080a70bd1c6a34de92a5e9aea591793ae08155a211ad3726

  • SHA512

    6742c064f7178be86e1d5e157d987445fbaa259c88043f4179f35d8ecba8d2d17765d9856985dfb6034bde4b0a3dbea1905d3be51587b974206fa6eaf6ddc38a

Malware Config

Extracted

Family

gozi_ifsb

Botnet

7626

C2

buredom.top

linkspremium.ru

premiumlists.ru

Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\readme.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\readme.dll,#1
      2⤵
        PID:4788
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 604
          3⤵
          • Program crash
          PID:2324
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4788 -ip 4788
      1⤵
        PID:4040

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/4788-134-0x0000000000550000-0x00000000005F8000-memory.dmp

              Filesize

              672KB

            • memory/4788-135-0x00000000006A0000-0x00000000006AE000-memory.dmp

              Filesize

              56KB

            • memory/4788-136-0x00000000006A0000-0x00000000006AE000-memory.dmp

              Filesize

              56KB

            • memory/4788-138-0x00000000006A0000-0x00000000006AE000-memory.dmp

              Filesize

              56KB

            • memory/4788-139-0x0000000000670000-0x000000000067C000-memory.dmp

              Filesize

              48KB