Analysis

  • max time kernel
    4294183s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    22/03/2022, 19:04

General

  • Target

    f762a352d68d6a4b5de6e1dfb97f695c.dll

  • Size

    654KB

  • MD5

    f762a352d68d6a4b5de6e1dfb97f695c

  • SHA1

    ae71e05af13607ec1339bb4e5c3dff70b93b822d

  • SHA256

    d6bbd7322d650172dc416d232a8965a35d18051d29634116df4f8cb175dd660d

  • SHA512

    d3129b92317e2bde49da4a191d079c657eabd6051fc55b28bf782a96aa65bd1dea17a40999c9931b5e5e62db6e9016afb4e1b2a0bda06455c0054d2b59541eb2

Malware Config

Extracted

Family

gozi_ifsb

Botnet

7626

C2

buredom.top

linkspremium.ru

premiumlists.ru

Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f762a352d68d6a4b5de6e1dfb97f695c.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f762a352d68d6a4b5de6e1dfb97f695c.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 224
        3⤵
        • Program crash
        PID:1952

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1664-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

          Filesize

          8KB

        • memory/1664-56-0x0000000000170000-0x000000000017E000-memory.dmp

          Filesize

          56KB

        • memory/1664-55-0x0000000000170000-0x000000000017E000-memory.dmp

          Filesize

          56KB

        • memory/1664-58-0x0000000000170000-0x000000000017E000-memory.dmp

          Filesize

          56KB

        • memory/1664-59-0x0000000000140000-0x000000000014C000-memory.dmp

          Filesize

          48KB