Analysis

  • max time kernel
    137s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2022 18:58

General

  • Target

    d94657449f8d8c165ef88fd93e463134.dll

  • Size

    760KB

  • MD5

    d94657449f8d8c165ef88fd93e463134

  • SHA1

    eb5cddacd6764098a20ce18a5e1e52f5e603e4ff

  • SHA256

    2502a3f8c9a6a8681f9222e93b14e077bf879e3009571c646ee94275bc994d01

  • SHA512

    659bc86dbd47d9f99c123db7c78d1bac68e4d592eed8f6d2d9ce5289cbf09bf893f0136a67e41e6dc59e1c826f19d34f8ffbaa5089c28592528ead595cca3ddb

  • SSDEEP

    12288:zCZAm0a9L7/7n/zUo2ThEQNvJZAHx137OyyyQTYzzCuatGfWE24rn2k2H824rn2y:wX9v/7/zYdNvnAR13pyyPa+n2F

Malware Config

Extracted

Family

gozi

Botnet

202206061

C2

https://daydayvin.xyz

https://gigiman.xyz

Attributes
  • host_keep_time

    2

  • host_shift_time

    1

  • idle_time

    1

  • request_time

    10

aes.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d94657449f8d8c165ef88fd93e463134.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\system32\cmd.exe
      cmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\E54C.tmp
      2⤵
        PID:1088
      • C:\Windows\system32\cmd.exe
        cmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\E54C.tmp
        2⤵
          PID:1520

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\E54C.tmp
        Filesize

        11B

        MD5

        a67f2061c697fd95f6b28d89b953a51f

        SHA1

        6730b864104f0840fcebf04383d2e3ef7c324a48

        SHA256

        d4bdd82a900fea52cbd442ce8cae201982392d3533d765bfceb7682bc2d16a79

        SHA512

        d9cc7c1593967dbcaf358bc9d394426d97baa7bb6ddeed1767b638c85aa814276eaa3609588b720cab3b2a0b3e36d1d3833dab3e75c9c1a92b8315db61a64cbe

      • C:\Users\Admin\AppData\Local\Temp\E54C.tmp
        Filesize

        3KB

        MD5

        c67b21d87383c2a931456a9097a2bfb1

        SHA1

        008ac48fe391911f14180d7928d6b9bf0ad956ae

        SHA256

        28a6ff74b4cd1e4234b6ee29720e0944f3c702cda0ab50556773641518bfcddc

        SHA512

        d45f7277e69a8b89046b5e0c33b434a5b9784c9953c2e0d9228be4572e2d9d1ec8af726af6473f6ddbf3755358308cb7643d98dfe6f9aef6d61c66aa3fc825d5

      • memory/1088-60-0x0000000000000000-mapping.dmp
      • memory/1520-61-0x0000000000000000-mapping.dmp
      • memory/1736-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp
        Filesize

        8KB

      • memory/1736-55-0x0000000180000000-0x0000000180012000-memory.dmp
        Filesize

        72KB