Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2023, 11:05
Behavioral task
behavioral1
Sample
stage_2gozi.dll
Resource
win7-20230220-en
1 signatures
150 seconds
General
-
Target
stage_2gozi.dll
-
Size
39KB
-
MD5
4984b442edb1cf12523faec4ad99c4ef
-
SHA1
5387e3fad9ee5d4e894f9ed8c6867c341f6dab11
-
SHA256
69d646441885a01d2203c17d5b38c1772d0f8cb76d0a43d33d143e7a0b13f6f8
-
SHA512
e0f7a261784c295fe86b6d5ef6ad25666cb32d7b7491212a9f8fce52d7436875221b90bb58964c44c55378e4101f65d0346dfc5df087876ae89a02fedbd887f1
-
SSDEEP
768:A2SGgWkKlrFv+y5NGQgGoKItuFe666yuwyF8sj1YsFVOZd43HmIt6J:MGtkKlA2oKItuLn3kfsLs9/
Malware Config
Extracted
Family
gozi
Botnet
5050
C2
https://config.edge.skype.com
91.215.85.201
Attributes
-
base_path
/jerry/
-
build
250255
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3804 wrote to memory of 3320 3804 regsvr32.exe 87 PID 3804 wrote to memory of 3320 3804 regsvr32.exe 87 PID 3804 wrote to memory of 3320 3804 regsvr32.exe 87