Resubmissions

27-10-2022 16:06

221027-tj9w2scfg8 10

25-08-2022 03:54

220825-egalvagbb9 1

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27-10-2022 16:06

General

  • Target

    utdh1.dll

  • Size

    760KB

  • MD5

    d94657449f8d8c165ef88fd93e463134

  • SHA1

    eb5cddacd6764098a20ce18a5e1e52f5e603e4ff

  • SHA256

    2502a3f8c9a6a8681f9222e93b14e077bf879e3009571c646ee94275bc994d01

  • SHA512

    659bc86dbd47d9f99c123db7c78d1bac68e4d592eed8f6d2d9ce5289cbf09bf893f0136a67e41e6dc59e1c826f19d34f8ffbaa5089c28592528ead595cca3ddb

  • SSDEEP

    12288:zCZAm0a9L7/7n/zUo2ThEQNvJZAHx137OyyyQTYzzCuatGfWE24rn2k2H824rn2y:wX9v/7/zYdNvnAR13pyyPa+n2F

Malware Config

Extracted

Family

gozi

Botnet

202206061

C2

https://daydayvin.xyz

https://gigiman.xyz

Attributes
  • host_keep_time

    2

  • host_shift_time

    1

  • idle_time

    1

  • request_time

    10

aes.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\utdh1.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Windows\system32\cmd.exe
      cmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\EE28.tmp
      2⤵
        PID:1088
      • C:\Windows\system32\cmd.exe
        cmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\EE28.tmp
        2⤵
          PID:828

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\EE28.tmp
        Filesize

        11B

        MD5

        a67f2061c697fd95f6b28d89b953a51f

        SHA1

        6730b864104f0840fcebf04383d2e3ef7c324a48

        SHA256

        d4bdd82a900fea52cbd442ce8cae201982392d3533d765bfceb7682bc2d16a79

        SHA512

        d9cc7c1593967dbcaf358bc9d394426d97baa7bb6ddeed1767b638c85aa814276eaa3609588b720cab3b2a0b3e36d1d3833dab3e75c9c1a92b8315db61a64cbe

      • C:\Users\Admin\AppData\Local\Temp\EE28.tmp
        Filesize

        3KB

        MD5

        c01f2098fab503d57ef742c6ca6680d8

        SHA1

        aeb71dd4ced18b7b45015f5b1ae24c1916ba5810

        SHA256

        10f8586621df0419894a8d8c33118d08566eb21e831a6f7e1db683ea5e020a81

        SHA512

        ab4735f98a7e937f95dae4f9da09bc9b8756949fa5b274290a8947b720d82f540fd105abdea14fefdd3671487df34fe117ad42dcd27b1d69ab0d4d6ca48d8f9d

      • memory/828-61-0x0000000000000000-mapping.dmp
      • memory/1088-60-0x0000000000000000-mapping.dmp
      • memory/1156-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp
        Filesize

        8KB

      • memory/1156-55-0x0000000180000000-0x0000000180012000-memory.dmp
        Filesize

        72KB