Analysis

  • max time kernel
    26s
  • max time network
    30s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    26-06-2022 23:44

General

  • Target

    35943095cc39a15c97a649b9ffec68237ecc054a1a567527f53e31e91b945f46.exe

  • Size

    547KB

  • MD5

    6ea1143bd122afcf587a28f06f9fc68f

  • SHA1

    eeb0b57985f52160b02160f10d90e170f29cdc3c

  • SHA256

    35943095cc39a15c97a649b9ffec68237ecc054a1a567527f53e31e91b945f46

  • SHA512

    f05a0d1ebbf71b5066bbd83ea505b9b80894d34bcbcbc6c87d14407babab32aec7eacb19e4a09b3654ba3bb0bd4e31fbd1f0726157ef62240f99bfc7392b74ec

Malware Config

Extracted

Family

gozi_ifsb

Attributes
  • build

    214062

Extracted

Family

gozi_ifsb

Botnet

3187

C2

qrodericky94.company

g77yelsao.company

tromainevirginia.email

Attributes
  • build

    214062

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\35943095cc39a15c97a649b9ffec68237ecc054a1a567527f53e31e91b945f46.exe
    "C:\Users\Admin\AppData\Local\Temp\35943095cc39a15c97a649b9ffec68237ecc054a1a567527f53e31e91b945f46.exe"
    1⤵
      PID:1028

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1028-130-0x0000000000AC0000-0x0000000000ACF000-memory.dmp
      Filesize

      60KB

    • memory/1028-131-0x0000000000AC0000-0x0000000000B5E000-memory.dmp
      Filesize

      632KB

    • memory/1028-133-0x0000000000870000-0x000000000088B000-memory.dmp
      Filesize

      108KB