Analysis
-
max time kernel
45s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
03-08-2022 16:03
Static task
static1
Behavioral task
behavioral1
Sample
de00c4750accf516704b8c0df265c24a.dll
Resource
win7-20220715-en
2 signatures
150 seconds
General
-
Target
de00c4750accf516704b8c0df265c24a.dll
-
Size
300KB
-
MD5
de00c4750accf516704b8c0df265c24a
-
SHA1
eddbc6019ec7ba82d3c5b4c59efe797ff1df9f75
-
SHA256
7dae6d6fb339b6114ffdd3c0b6bcaa2c9dab0a73979fec029801e9e16d7d06bc
-
SHA512
b0e6bbbdae36bd81f63dbab9296515d3a389fa6acb397476058ae202e66026ca8dc523fb35c6b7145a87d6e61e3833e396873e61e733152ccbaa39387bada96f
Malware Config
Extracted
Family
gozi_ifsb
Botnet
3000
C2
config.edge.skype.com
37.120.206.71
37.120.206.84
193.106.191.163
Attributes
-
base_path
/drew/
-
build
250240
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1092 wrote to memory of 1644 1092 regsvr32.exe regsvr32.exe PID 1092 wrote to memory of 1644 1092 regsvr32.exe regsvr32.exe PID 1092 wrote to memory of 1644 1092 regsvr32.exe regsvr32.exe PID 1092 wrote to memory of 1644 1092 regsvr32.exe regsvr32.exe PID 1092 wrote to memory of 1644 1092 regsvr32.exe regsvr32.exe PID 1092 wrote to memory of 1644 1092 regsvr32.exe regsvr32.exe PID 1092 wrote to memory of 1644 1092 regsvr32.exe regsvr32.exe