Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
10-08-2022 14:39
Static task
static1
Behavioral task
behavioral1
Sample
31a1197c1f7a1cb2b53bd1bb7fe2e1f8.dll
Resource
win7-20220715-en
2 signatures
150 seconds
General
-
Target
31a1197c1f7a1cb2b53bd1bb7fe2e1f8.dll
-
Size
300KB
-
MD5
31a1197c1f7a1cb2b53bd1bb7fe2e1f8
-
SHA1
b30bf29948b2905db6b106d868b334e423ff4ebe
-
SHA256
1277c4177d2b564b221a369c587c6a99558253234f37bfbf19fef3a63bce88b5
-
SHA512
6e65cada52581339a702ae83b63c83a2b52a8982b30b117042cec5e7fac44c61e27d2286ecc3d3fb89ed04ad4bef8414183d0bdd81c109a656b0e158f82b4ef7
Malware Config
Extracted
Family
gozi_ifsb
Botnet
3000
C2
config.edge.skype.com
79.110.52.8
79.110.52.80
193.106.191.163
Attributes
-
base_path
/drew/
-
build
250240
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 760 wrote to memory of 1996 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1996 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1996 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1996 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1996 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1996 760 regsvr32.exe regsvr32.exe PID 760 wrote to memory of 1996 760 regsvr32.exe regsvr32.exe