Analysis
-
max time kernel
585s -
max time network
587s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
26-10-2022 23:52
Static task
static1
Behavioral task
behavioral1
Sample
0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe
Resource
win7-20220901-en
windows7-x64
4 signatures
600 seconds
General
-
Target
0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe
-
Size
119KB
-
MD5
01bb1ed3dc487fbd3de3587f887cac75
-
SHA1
560d9fa7931356a2ddfc7b226a6d3ebdb842473a
-
SHA256
0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9
-
SHA512
8da4994df14934ea5ec837ff6cf640dee51f5431604648bee5b1297cb7f4a0fd14deaf2350d14d51f15efbafe82301b0fa344d24f9a2f4a2c94acd9fe8539320
-
SSDEEP
3072:3Uzhx2Mnwol3C/6/MKPf75hIGAUmUmU3Y:EDfw83C4NomBB
Malware Config
Extracted
Family
gozi_ifsb
Botnet
1091
C2
pop.project-ip.co.uk
Attributes
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
rsa_pubkey.plain
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exedescription pid process target process PID 832 set thread context of 1132 832 0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exepid process 832 0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exedescription pid process target process PID 832 wrote to memory of 1132 832 0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe svchost.exe PID 832 wrote to memory of 1132 832 0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe svchost.exe PID 832 wrote to memory of 1132 832 0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe svchost.exe PID 832 wrote to memory of 1132 832 0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe svchost.exe PID 832 wrote to memory of 1132 832 0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe svchost.exe PID 832 wrote to memory of 1132 832 0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe svchost.exe PID 832 wrote to memory of 1132 832 0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe"C:\Users\Admin\AppData\Local\Temp\0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/832-55-0x0000000000401000-0x0000000000405000-memory.dmpFilesize
16KB
-
memory/832-56-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1132-57-0x0000000000000000-mapping.dmp
-
memory/1132-58-0x00000000000D0000-0x0000000000101000-memory.dmpFilesize
196KB