Analysis
-
max time kernel
137s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21-11-2022 18:58
Static task
static1
Behavioral task
behavioral1
Sample
d94657449f8d8c165ef88fd93e463134.dll
Resource
win7-20221111-en
General
-
Target
d94657449f8d8c165ef88fd93e463134.dll
-
Size
760KB
-
MD5
d94657449f8d8c165ef88fd93e463134
-
SHA1
eb5cddacd6764098a20ce18a5e1e52f5e603e4ff
-
SHA256
2502a3f8c9a6a8681f9222e93b14e077bf879e3009571c646ee94275bc994d01
-
SHA512
659bc86dbd47d9f99c123db7c78d1bac68e4d592eed8f6d2d9ce5289cbf09bf893f0136a67e41e6dc59e1c826f19d34f8ffbaa5089c28592528ead595cca3ddb
-
SSDEEP
12288:zCZAm0a9L7/7n/zUo2ThEQNvJZAHx137OyyyQTYzzCuatGfWE24rn2k2H824rn2y:wX9v/7/zYdNvnAR13pyyPa+n2F
Malware Config
Extracted
gozi
202206061
https://daydayvin.xyz
https://gigiman.xyz
-
host_keep_time
2
-
host_shift_time
1
-
idle_time
1
-
request_time
10
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1736 wrote to memory of 1088 1736 regsvr32.exe cmd.exe PID 1736 wrote to memory of 1088 1736 regsvr32.exe cmd.exe PID 1736 wrote to memory of 1088 1736 regsvr32.exe cmd.exe PID 1736 wrote to memory of 1520 1736 regsvr32.exe cmd.exe PID 1736 wrote to memory of 1520 1736 regsvr32.exe cmd.exe PID 1736 wrote to memory of 1520 1736 regsvr32.exe cmd.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d94657449f8d8c165ef88fd93e463134.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\E54C.tmp2⤵
-
C:\Windows\system32\cmd.execmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\E54C.tmp2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\E54C.tmpFilesize
11B
MD5a67f2061c697fd95f6b28d89b953a51f
SHA16730b864104f0840fcebf04383d2e3ef7c324a48
SHA256d4bdd82a900fea52cbd442ce8cae201982392d3533d765bfceb7682bc2d16a79
SHA512d9cc7c1593967dbcaf358bc9d394426d97baa7bb6ddeed1767b638c85aa814276eaa3609588b720cab3b2a0b3e36d1d3833dab3e75c9c1a92b8315db61a64cbe
-
C:\Users\Admin\AppData\Local\Temp\E54C.tmpFilesize
3KB
MD5c67b21d87383c2a931456a9097a2bfb1
SHA1008ac48fe391911f14180d7928d6b9bf0ad956ae
SHA25628a6ff74b4cd1e4234b6ee29720e0944f3c702cda0ab50556773641518bfcddc
SHA512d45f7277e69a8b89046b5e0c33b434a5b9784c9953c2e0d9228be4572e2d9d1ec8af726af6473f6ddbf3755358308cb7643d98dfe6f9aef6d61c66aa3fc825d5
-
memory/1088-60-0x0000000000000000-mapping.dmp
-
memory/1520-61-0x0000000000000000-mapping.dmp
-
memory/1736-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmpFilesize
8KB
-
memory/1736-55-0x0000000180000000-0x0000000180012000-memory.dmpFilesize
72KB