Analysis
-
max time kernel
5s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-06-2022 21:37
Static task
static1
Behavioral task
behavioral1
Sample
2cccdc51aea02049dc7f96f510a13311f112096a7d870a97d70232356ddef42b.exe
Resource
win7-20220414-en
General
-
Target
2cccdc51aea02049dc7f96f510a13311f112096a7d870a97d70232356ddef42b.exe
-
Size
170KB
-
MD5
3bd6e630c3d5bf7cca5c948ccef44d81
-
SHA1
6a0074a24c98ee2e7dc00d113b4417769eba92e8
-
SHA256
2cccdc51aea02049dc7f96f510a13311f112096a7d870a97d70232356ddef42b
-
SHA512
b39ed8abadb905616fe66cf3b4f09fffacd938dcf6fe8899254e2b57b6ac6f2e1554c55943d037b11a7c129ad570191312658e43ed1d908efce6888bb4c863da
Malware Config
Extracted
gozi_ifsb
2000
beetfeetlife.bit/webstore
api.sorna.at/webstore
supp.rivier.at/webstore
-
build
217072
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
dns_servers
193.183.98.66
91.217.137.37
192.71.245.208
8.8.8.8
178.17.170.179
82.196.9.45
151.80.222.79
68.183.70.217
217.144.135.7
158.69.160.164
207.148.83.241
5.189.170.196
217.144.132.148
94.247.43.254
188.165.200.156
159.89.249.249
150.249.149.222
-
exe_type
loader
-
server_id
550
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1492-54-0x0000000000400000-0x00000000008EA000-memory.dmp upx
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1492-54-0x0000000000400000-0x00000000008EA000-memory.dmpFilesize
4.9MB
-
memory/1492-55-0x0000000000AEC000-0x0000000000AF7000-memory.dmpFilesize
44KB
-
memory/1492-56-0x0000000000250000-0x000000000026B000-memory.dmpFilesize
108KB
-
memory/1492-59-0x0000000000AEC000-0x0000000000AF7000-memory.dmpFilesize
44KB