Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
09-08-2022 12:40
Static task
static1
Behavioral task
behavioral1
Sample
f9d778ad3bfea174401f36a2d88851d8.dll
Resource
win7-20220718-en
2 signatures
150 seconds
General
-
Target
f9d778ad3bfea174401f36a2d88851d8.dll
-
Size
378KB
-
MD5
f9d778ad3bfea174401f36a2d88851d8
-
SHA1
fd2b30e2f029939c31c759d9fbdd5ee5242137c0
-
SHA256
44026db9b82303793e896838dd9e85def8b501ec72e3b64584db38212ea312f5
-
SHA512
046ee69e01fc2e64b3cf75ccfa9a0886ef4e6752f9d90e199c67b8cc9cfdf767d8235b3a638fc96782cea0ff1b278f8d36a2ea25c9a5a839c0c03d199de5175a
Malware Config
Extracted
Family
gozi_ifsb
Botnet
3000
C2
config.edge.skype.com
79.110.52.8
79.110.52.80
193.106.191.163
Attributes
-
base_path
/drew/
-
build
250240
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1956 wrote to memory of 1968 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1968 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1968 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1968 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1968 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1968 1956 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1968 1956 regsvr32.exe regsvr32.exe