Analysis
-
max time kernel
142s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2023, 10:27
Static task
static1
Behavioral task
behavioral1
Sample
6419864dceb72.dll
Resource
win7-20230220-en
2 signatures
150 seconds
General
-
Target
6419864dceb72.dll
-
Size
217KB
-
MD5
e8f17a3011cf011942a5ed07c7aaaaf8
-
SHA1
fc60327c142041f4486a6a814fc2c8059bc9042c
-
SHA256
3ffc3c329ace3bf652db9d8fdcdb7ef19fd1563d39b3ef3934e0170209f03382
-
SHA512
df2ab459a3cf3f62bce250565e2165d7edf4eb046f385c1e96403993e9f2e9cb71ebb9cfb26458e3366d2ec92833c2cb53fb52f461cef1c265e6ab563c1f1119
-
SSDEEP
3072:7XFEOXctZScgJKooUngEKpXXaAFwxokUiZQxvudEGyWGKYu:zF5apg8LUngEKp65okUiZM0yWGT
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
https://config.edge.skype.com
91.215.85.201
Attributes
-
base_path
/jerry/
-
build
250255
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1288 wrote to memory of 2044 1288 regsvr32.exe 86 PID 1288 wrote to memory of 2044 1288 regsvr32.exe 86 PID 1288 wrote to memory of 2044 1288 regsvr32.exe 86