Analysis

  • max time kernel
    43s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    27-05-2022 20:52

General

  • Target

    0481ac6888528c9d97a55c3d8d0e810f4d4bf684359257ad401072075f6cc974.exe

  • Size

    372KB

  • MD5

    fd8fffe769a70ec3ded21ab4ec1627db

  • SHA1

    526e75ac2fbea867a52e84aecc6dfd9f4c06dad8

  • SHA256

    0481ac6888528c9d97a55c3d8d0e810f4d4bf684359257ad401072075f6cc974

  • SHA512

    7e6f09de3bbd18af1b42857db8c5f19563f0036df4b80bb7c7ca63f99dacdce5ccc6047216b837460a9b58f4ad9e0424845e5ecd15649b19cc247d8541c1086e

Malware Config

Extracted

Family

gozi_ifsb

Attributes
  • build

    214062

Extracted

Family

gozi_ifsb

Botnet

3181

C2

bm25yp.com

xiivhaaou.email

m264591jasen.city

Attributes
  • build

    214062

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\0481ac6888528c9d97a55c3d8d0e810f4d4bf684359257ad401072075f6cc974.exe
    "C:\Users\Admin\AppData\Local\Temp\0481ac6888528c9d97a55c3d8d0e810f4d4bf684359257ad401072075f6cc974.exe"
    1⤵
      PID:1624

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1624-54-0x0000000075C71000-0x0000000075C73000-memory.dmp
      Filesize

      8KB

    • memory/1624-56-0x0000000000400000-0x000000000046D000-memory.dmp
      Filesize

      436KB

    • memory/1624-55-0x0000000000400000-0x000000000040F000-memory.dmp
      Filesize

      60KB

    • memory/1624-57-0x0000000000310000-0x000000000032B000-memory.dmp
      Filesize

      108KB