Analysis
-
max time kernel
141s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/03/2023, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
3ffc3c329ace3bf652db9d8fdcdb7ef19fd1563d39b3ef3934e0170209f03382.dll
Resource
win7-20230220-en
2 signatures
150 seconds
General
-
Target
3ffc3c329ace3bf652db9d8fdcdb7ef19fd1563d39b3ef3934e0170209f03382.dll
-
Size
217KB
-
MD5
e8f17a3011cf011942a5ed07c7aaaaf8
-
SHA1
fc60327c142041f4486a6a814fc2c8059bc9042c
-
SHA256
3ffc3c329ace3bf652db9d8fdcdb7ef19fd1563d39b3ef3934e0170209f03382
-
SHA512
df2ab459a3cf3f62bce250565e2165d7edf4eb046f385c1e96403993e9f2e9cb71ebb9cfb26458e3366d2ec92833c2cb53fb52f461cef1c265e6ab563c1f1119
-
SSDEEP
3072:7XFEOXctZScgJKooUngEKpXXaAFwxokUiZQxvudEGyWGKYu:zF5apg8LUngEKp65okUiZM0yWGT
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
https://config.edge.skype.com
91.215.85.201
Attributes
-
base_path
/jerry/
-
build
250255
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1540 wrote to memory of 1416 1540 regsvr32.exe 28 PID 1540 wrote to memory of 1416 1540 regsvr32.exe 28 PID 1540 wrote to memory of 1416 1540 regsvr32.exe 28 PID 1540 wrote to memory of 1416 1540 regsvr32.exe 28 PID 1540 wrote to memory of 1416 1540 regsvr32.exe 28 PID 1540 wrote to memory of 1416 1540 regsvr32.exe 28 PID 1540 wrote to memory of 1416 1540 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3ffc3c329ace3bf652db9d8fdcdb7ef19fd1563d39b3ef3934e0170209f03382.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\3ffc3c329ace3bf652db9d8fdcdb7ef19fd1563d39b3ef3934e0170209f03382.dll2⤵PID:1416
-