Analysis
-
max time kernel
36s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14/06/2022, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
62a8495f3b293.dll
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
62a8495f3b293.dll
-
Size
436KB
-
MD5
dd165240f5a2de250727eb47e458d7db
-
SHA1
2748f39c430664f6c4c9c1700f1b7d05908d8dfd
-
SHA256
ce3d465a139b6c7ca2b3414a08230b50b1e2e341310113ada498c2aecdce1d96
-
SHA512
5e33d29014cb99754bacd08b766e3f611ed7711c217b4cb26bbc7836a738e06a9a88d960b916e6148320f0d0ba6a4583a2ed1f600af4ea696af30d1ddfec347d
Malware Config
Extracted
Family
gozi_ifsb
Botnet
3000
C2
config.edge.skype.com
194.76.226.15
109.230.199.114
Attributes
-
base_path
/drew/
-
build
250235
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1100 1620 rundll32.exe 26 PID 1620 wrote to memory of 1100 1620 rundll32.exe 26 PID 1620 wrote to memory of 1100 1620 rundll32.exe 26 PID 1620 wrote to memory of 1100 1620 rundll32.exe 26 PID 1620 wrote to memory of 1100 1620 rundll32.exe 26 PID 1620 wrote to memory of 1100 1620 rundll32.exe 26 PID 1620 wrote to memory of 1100 1620 rundll32.exe 26