Analysis
-
max time kernel
541s -
max time network
544s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-10-2022 23:52
General
-
Target
0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe
-
Size
119KB
-
MD5
01bb1ed3dc487fbd3de3587f887cac75
-
SHA1
560d9fa7931356a2ddfc7b226a6d3ebdb842473a
-
SHA256
0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9
-
SHA512
8da4994df14934ea5ec837ff6cf640dee51f5431604648bee5b1297cb7f4a0fd14deaf2350d14d51f15efbafe82301b0fa344d24f9a2f4a2c94acd9fe8539320
-
SSDEEP
3072:3Uzhx2Mnwol3C/6/MKPf75hIGAUmUmU3Y:EDfw83C4NomBB
Score
10/10
Malware Config
Extracted
Family
gozi_ifsb
Botnet
1091
C2
pop.project-ip.co.uk
Attributes
-
exe_type
loader
-
server_id
12
rsa_pubkey.plain
serpent.plain
rsa_pubkey.plain
Signatures
-
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe"C:\Users\Admin\AppData\Local\Temp\0d6014f1d2487230c3bb38f31d2742577f84fd2f2e0d97be5fb9cf28b7ab6de9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1152-133-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1152-132-0x0000000000401000-0x0000000000405000-memory.dmpFilesize
16KB
-
memory/4912-134-0x0000000000000000-mapping.dmp
-
memory/4912-135-0x0000000000AB0000-0x0000000000AE1000-memory.dmpFilesize
196KB