Resubmissions
24-07-2023 06:52
230724-hngwaaah72 1027-10-2022 16:06
221027-tj34hacgfk 1031-08-2022 10:16
220831-massvacgbl 1Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-10-2022 16:06
Static task
static1
Behavioral task
behavioral1
Sample
x.dll
Resource
win7-20220812-en
General
-
Target
x.dll
-
Size
429KB
-
MD5
f4b0a6ab164f7c58cccce651606caede
-
SHA1
e893352eb4df504843cb3e8588d59593a9757937
-
SHA256
88de34ad95486071b8796d95150461a8a7968d1eb8817772e892d258f3aa1c91
-
SHA512
0a305d740ff8074fb9ed2b501316beee4c33d48f35728665b7fa0f3a2b7b3efb6731ec0e2245e296822a8e640e4f1439c24e1870c4080ac211d4ac11c5de43e5
-
SSDEEP
12288:yd/Qeei+XrnguJYoeYcWDCkz+oI2u024rn2M24rn2h125HRB:yd//m7nzK262h
Malware Config
Extracted
gozi
202208152
https://fishenddog.xyz
https://minotos.xyz
-
host_keep_time
2
-
host_shift_time
1
-
idle_time
1
-
request_time
10
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exedescription pid Process procid_target PID 1960 wrote to memory of 1004 1960 regsvr32.exe 28 PID 1960 wrote to memory of 1004 1960 regsvr32.exe 28 PID 1960 wrote to memory of 1004 1960 regsvr32.exe 28 PID 1960 wrote to memory of 1208 1960 regsvr32.exe 30 PID 1960 wrote to memory of 1208 1960 regsvr32.exe 30 PID 1960 wrote to memory of 1208 1960 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\x.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\system32\cmd.execmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\C1EC.tmp2⤵PID:1004
-
-
C:\Windows\system32\cmd.execmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\C1EC.tmp2⤵PID:1208
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e4741513d73213cb521d60bd9a8aad85
SHA111643a455c21e23c3d23210aa8e0f2c340b0a1ae
SHA256d5796f534cb444e8f8be579a426d9f410d11e76e348b87a3ffbea4b46663b9ee
SHA5127899bb2700fa1205eeaa61caf718fe21b9aca90527c3ee22cc414914ded94dd04ad79fbfe58b5eeee74fe012ade9cac76a04b8851a911371374072ef30d3f9d9
-
Filesize
3KB
MD5e4741513d73213cb521d60bd9a8aad85
SHA111643a455c21e23c3d23210aa8e0f2c340b0a1ae
SHA256d5796f534cb444e8f8be579a426d9f410d11e76e348b87a3ffbea4b46663b9ee
SHA5127899bb2700fa1205eeaa61caf718fe21b9aca90527c3ee22cc414914ded94dd04ad79fbfe58b5eeee74fe012ade9cac76a04b8851a911371374072ef30d3f9d9