Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2023, 11:06
Behavioral task
behavioral1
Sample
stage_2gozi.dll
Resource
win7-20230220-en
1 signatures
150 seconds
General
-
Target
stage_2gozi.dll
-
Size
39KB
-
MD5
4984b442edb1cf12523faec4ad99c4ef
-
SHA1
5387e3fad9ee5d4e894f9ed8c6867c341f6dab11
-
SHA256
69d646441885a01d2203c17d5b38c1772d0f8cb76d0a43d33d143e7a0b13f6f8
-
SHA512
e0f7a261784c295fe86b6d5ef6ad25666cb32d7b7491212a9f8fce52d7436875221b90bb58964c44c55378e4101f65d0346dfc5df087876ae89a02fedbd887f1
-
SSDEEP
768:A2SGgWkKlrFv+y5NGQgGoKItuFe666yuwyF8sj1YsFVOZd43HmIt6J:MGtkKlA2oKItuLn3kfsLs9/
Malware Config
Extracted
Family
gozi
Botnet
5050
C2
https://config.edge.skype.com
91.215.85.201
Attributes
-
base_path
/jerry/
-
build
250255
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1816 1124 regsvr32.exe 85 PID 1124 wrote to memory of 1816 1124 regsvr32.exe 85 PID 1124 wrote to memory of 1816 1124 regsvr32.exe 85