Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
03-08-2022 17:54
Static task
static1
Behavioral task
behavioral1
Sample
aa856dedda137f7419ecc36766ed74e3.dll
Resource
win7-20220715-en
2 signatures
150 seconds
General
-
Target
aa856dedda137f7419ecc36766ed74e3.dll
-
Size
300KB
-
MD5
aa856dedda137f7419ecc36766ed74e3
-
SHA1
59a685b1ddd500747678ed66ffdb1afadb7b8023
-
SHA256
9ec85fa9097826fce61020be2f15ed01c320109c7ec3654c2a42b1b5c46b4b6f
-
SHA512
60dcb99e96369c32fc8330570021225575b01c3e7b4ecd42554d0b5dbca2796cdb86f93630b32c836892b67a3b50ff8b7594cff43d02a85f8822beb638011fff
Malware Config
Extracted
Family
gozi_ifsb
Botnet
3000
C2
config.edge.skype.com
37.120.206.71
37.120.206.84
193.106.191.163
Attributes
-
base_path
/drew/
-
build
250240
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1932 wrote to memory of 1832 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1832 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1832 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1832 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1832 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1832 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1832 1932 regsvr32.exe regsvr32.exe