Analysis

  • max time kernel
    44s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    15/06/2022, 00:35

General

  • Target

    2be5467b5f4594465e2d922ffbd4c6bdd715570f089702548dd39abc81e44d0a.exe

  • Size

    351KB

  • MD5

    fc607132a04837db62b0118a7122c124

  • SHA1

    96f053bc72a6475391de59d4e728768b2842d1b6

  • SHA256

    2be5467b5f4594465e2d922ffbd4c6bdd715570f089702548dd39abc81e44d0a

  • SHA512

    0db952ae4f0f7e0cd9a84044e38d1110cc3f3a27e9345c42de0c8997df1502a3ffba54cb321d8a765bf5824ba2274965cce0a10a488d796ece37ea7e1d765505

Malware Config

Extracted

Family

gozi_ifsb

Attributes
  • build

    214085

Extracted

Family

gozi_ifsb

Botnet

3455

C2

google.com

gmail.com

shvaiwq.com

xupqcornelliy.com

swiu45hildegard.top

Attributes
  • build

    214085

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2be5467b5f4594465e2d922ffbd4c6bdd715570f089702548dd39abc81e44d0a.exe
    "C:\Users\Admin\AppData\Local\Temp\2be5467b5f4594465e2d922ffbd4c6bdd715570f089702548dd39abc81e44d0a.exe"
    1⤵
      PID:1580

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1580-131-0x0000000000720000-0x0000000000826000-memory.dmp

            Filesize

            1.0MB

          • memory/1580-130-0x0000000000720000-0x000000000072E000-memory.dmp

            Filesize

            56KB

          • memory/1580-132-0x0000000000EF0000-0x0000000000EFF000-memory.dmp

            Filesize

            60KB