Analysis
-
max time kernel
141s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25-03-2023 07:06
Static task
static1
Behavioral task
behavioral1
Sample
server.exe
Resource
win7-20230220-en
windows7-x64
1 signatures
150 seconds
General
-
Target
server.exe
-
Size
248KB
-
MD5
47a28863984e5acee7a4aadba0798b81
-
SHA1
4b49af83cb30cce8ca6d270b8104c0cbb9ea7d1a
-
SHA256
120bb72f63c759f9639de69b6c69ef7044ba8aad6de42d828ad41ce5c9c2c2e9
-
SHA512
d5d99a652f91bb09042757bd82536111cb9679772028519373455b5b02a3b2bc298032093ab121afc31dbf9a8dd3d5ebeb40fc0edaf317b3060c12327ca71195
-
SSDEEP
3072:4jKaOORqiFXz3KcIix5QeiD/XabN9hrbOo52p2pkyr8tYa4PVorWN8aeDr:QzOpum5aCS9hrbOjspffV2va
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
7716
C2
checklist.skype.com
193.233.175.115
185.68.93.20
62.173.140.250
46.8.210.133
Attributes
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1676-55-0x00000000001B0000-0x00000000001BB000-memory.dmpFilesize
44KB
-
memory/1676-56-0x0000000000400000-0x0000000002B6C000-memory.dmpFilesize
39.4MB
-
memory/1676-57-0x0000000000400000-0x0000000002B6C000-memory.dmpFilesize
39.4MB
-
memory/1676-58-0x0000000000400000-0x0000000002B6C000-memory.dmpFilesize
39.4MB
-
memory/1676-59-0x0000000000400000-0x0000000002B6C000-memory.dmpFilesize
39.4MB
-
memory/1676-61-0x00000000002D0000-0x00000000002DD000-memory.dmpFilesize
52KB
-
memory/1676-64-0x0000000000400000-0x0000000002B6C000-memory.dmpFilesize
39.4MB