Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
21-11-2022 15:36
Static task
static1
Behavioral task
behavioral1
Sample
360417f75090c962adb8021dbb478f67.dll
Resource
win7-20220901-en
General
-
Target
360417f75090c962adb8021dbb478f67.dll
-
Size
437KB
-
MD5
360417f75090c962adb8021dbb478f67
-
SHA1
5cd71ee15351c08ff35785774cc18dcaeca871c9
-
SHA256
eb2564a6f22dcec73dda3b6e4dc5fd37a4fa017f6b98b6dea5ac5b23a44b1f57
-
SHA512
62088b203fe1eb61afbded8d64c0c00c682d421f73cbc688122c4e81a95924a648632c40ebf734d8693d5373c89bdbcf33ced5df115616dd96341414b4247390
-
SSDEEP
12288:MNQGRYLUC/k+JwgIMinOCCdF4F9Bn/TomHe:MNQGRQUC/ZwMO1IFq9BnU
Malware Config
Extracted
gozi
202206061
https://daydayvin.xyz
https://gigiman.xyz
-
host_keep_time
2
-
host_shift_time
1
-
idle_time
1
-
request_time
10
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exedescription pid process target process PID 960 wrote to memory of 916 960 regsvr32.exe cmd.exe PID 960 wrote to memory of 916 960 regsvr32.exe cmd.exe PID 960 wrote to memory of 916 960 regsvr32.exe cmd.exe PID 960 wrote to memory of 1484 960 regsvr32.exe cmd.exe PID 960 wrote to memory of 1484 960 regsvr32.exe cmd.exe PID 960 wrote to memory of 1484 960 regsvr32.exe cmd.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\360417f75090c962adb8021dbb478f67.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\5AEC.tmp2⤵
-
C:\Windows\system32\cmd.execmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\5AEC.tmp2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5AEC.tmpFilesize
11B
MD5a67f2061c697fd95f6b28d89b953a51f
SHA16730b864104f0840fcebf04383d2e3ef7c324a48
SHA256d4bdd82a900fea52cbd442ce8cae201982392d3533d765bfceb7682bc2d16a79
SHA512d9cc7c1593967dbcaf358bc9d394426d97baa7bb6ddeed1767b638c85aa814276eaa3609588b720cab3b2a0b3e36d1d3833dab3e75c9c1a92b8315db61a64cbe
-
C:\Users\Admin\AppData\Local\Temp\5AEC.tmpFilesize
3KB
MD5dc2d1cbee959113a3b49847a229d70d1
SHA172e2e56da62a6a9586d209ab27b213b037d9cf1e
SHA25605f5f9d77a0fe33ba79c1bdf397a5a714332977e0b7797a489233d8b30cacfb8
SHA512697ee42239f7237f90d9038d83b687acea9c06115cc5f21d74a7bdc508d42b2111090113c2e88ce6a244f40989546a6ceaa5a0c0f10ed8c8fed7b7f9658bd9a5
-
memory/916-60-0x0000000000000000-mapping.dmp
-
memory/960-54-0x000007FEFC011000-0x000007FEFC013000-memory.dmpFilesize
8KB
-
memory/960-55-0x0000000180000000-0x0000000180012000-memory.dmpFilesize
72KB
-
memory/1484-61-0x0000000000000000-mapping.dmp