Analysis
-
max time kernel
3s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 03:23
Static task
static1
Behavioral task
behavioral1
Sample
4562a92e37f64f81870fb4d0b448f6949d8dc2783b5f0328f6c9d3d5eebbef34.exe
Resource
win7-20220414-en
General
-
Target
4562a92e37f64f81870fb4d0b448f6949d8dc2783b5f0328f6c9d3d5eebbef34.exe
-
Size
150KB
-
MD5
87a6cc5ffd0bceae7542e1b12929ac39
-
SHA1
fcfbe6dde4b0418ce75c5c57c1aaf50f612fa70f
-
SHA256
4562a92e37f64f81870fb4d0b448f6949d8dc2783b5f0328f6c9d3d5eebbef34
-
SHA512
064ae7484e91657bfd560473a4b53065de556004d994cae1855e42971266c47bd13fccf0db0c9781e116730237b86fea4c5d1bfa27309453794419b9f78b848e
Malware Config
Extracted
gozi_ifsb
2000
ax.ikobut.at/webstore
beetfeetlife.bit/webstore
foo.avaregio.at/webstore
api.hamanana.at/webstore
api.ikobut.at/webstore
supp.zapkopw.at/webstore
cdn.avaregio.at/webstore
-
build
217061
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
dns_servers
193.183.98.66
91.217.137.37
192.71.245.208
8.8.8.8
178.17.170.179
82.196.9.45
151.80.222.79
68.183.70.217
217.144.135.7
158.69.160.164
207.148.83.241
5.189.170.196
217.144.132.148
94.247.43.254
188.165.200.156
159.89.249.249
150.249.149.222
-
exe_type
loader
-
server_id
550
Signatures
-
Processes:
resource yara_rule behavioral1/memory/968-54-0x0000000000400000-0x0000000000456000-memory.dmp upx
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/968-54-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/968-55-0x0000000000240000-0x000000000025B000-memory.dmpFilesize
108KB
-
memory/968-58-0x000000000060C000-0x0000000000618000-memory.dmpFilesize
48KB
-
memory/968-59-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB