Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
14/02/2023, 12:15 UTC
General
-
Target
45801ddcea54e60f804a3e217b91eb998e67ed592c4894fa9a0b4cecaa3c8b2c.dll
-
Size
478KB
-
MD5
a680574ade5140ed02c9c36bde94f1d9
-
SHA1
7bc6ac0a197efc9d894b586b1cd00c5b6fb1f6a0
-
SHA256
45801ddcea54e60f804a3e217b91eb998e67ed592c4894fa9a0b4cecaa3c8b2c
-
SHA512
cf505bb0556ac84944c5073f0baf5ecae7009e4ab4a1ed84421155b7cf658f07dfbda01461e2616a56186a81d41a05fee394790bec070d398704cf21af729c11
-
SSDEEP
6144:4dhdVjFYJCovXPXqtBwlK4sPY3qrRM9ZO5/pQML1oKcG5wSlD2t+:OjFGfvXPXiUK4BAM90cG5Q
Score
10/10
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
1000
C2
https://mereter.cloud
Attributes
-
host_keep_time
2
-
host_shift_time
1
-
idle_time
1
-
request_time
10
aes.plain
1
oEKAGSfDCJKsbAEB
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Program crash 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\45801ddcea54e60f804a3e217b91eb998e67ed592c4894fa9a0b4cecaa3c8b2c.dll1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4664 -s 4122⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 4664 -ip 46641⤵
Network
- No results found
-
20.189.173.11:443 -
104.80.225.205:443
No results found
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
76KB