Analysis

  • max time kernel
    124s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-01-2023 21:57

General

  • Target

    Zeip.dll

  • Size

    592KB

  • MD5

    85fa54c2a97ad3a1f8bd64af62450511

  • SHA1

    db92c0a81e8b27d222607e093ccc9d00485db119

  • SHA256

    e609894b274a6c42e971e8082af8fd167ade4aef5d1a3816d5acea04839f0b35

  • SHA512

    6c6faba5f566e3c383d676c736319a7a70138070b0d9771727a1c7756718a4add05db8a7c3a5b038b9269a0ecb14434872516912faea8e2479729a192f9a4b4b

  • SSDEEP

    12288:cysmuJC4fktsdyjJGL44Clz8JwsWydYo9NRl:cT7IoyjXTKdlnz

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

20005

C2

trackingg-protectioon.cdn4.mozilla.net

80.77.23.77

80.77.25.109

protectioon.cdn4.mozilla.net

170.130.165.182

80.77.25.114

Attributes
  • base_path

    /fonts/

  • build

    250250

  • exe_type

    loader

  • extension

    .bak

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Blocklisted process makes network request 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Zeip.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3756
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Zeip.dll,#1
      2⤵
      • Blocklisted process makes network request
      PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4976-132-0x0000000000000000-mapping.dmp
  • memory/4976-133-0x0000000000400000-0x0000000000496000-memory.dmp
    Filesize

    600KB

  • memory/4976-135-0x0000000002BE0000-0x0000000002BED000-memory.dmp
    Filesize

    52KB

  • memory/4976-138-0x0000000000F10000-0x0000000000F16000-memory.dmp
    Filesize

    24KB