Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 07:06
Static task
static1
Behavioral task
behavioral1
Sample
server.exe
Resource
win7-20230220-en
windows7-x64
1 signatures
150 seconds
General
-
Target
server.exe
-
Size
248KB
-
MD5
47a28863984e5acee7a4aadba0798b81
-
SHA1
4b49af83cb30cce8ca6d270b8104c0cbb9ea7d1a
-
SHA256
120bb72f63c759f9639de69b6c69ef7044ba8aad6de42d828ad41ce5c9c2c2e9
-
SHA512
d5d99a652f91bb09042757bd82536111cb9679772028519373455b5b02a3b2bc298032093ab121afc31dbf9a8dd3d5ebeb40fc0edaf317b3060c12327ca71195
-
SSDEEP
3072:4jKaOORqiFXz3KcIix5QeiD/XabN9hrbOo52p2pkyr8tYa4PVorWN8aeDr:QzOpum5aCS9hrbOjspffV2va
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
7716
C2
checklist.skype.com
193.233.175.115
185.68.93.20
62.173.140.250
46.8.210.133
Attributes
-
base_path
/drew/
-
build
250255
-
exe_type
loader
-
extension
.jlk
-
server_id
50
rsa_pubkey.plain
aes.plain
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5028-134-0x0000000002E00000-0x0000000002E0B000-memory.dmpFilesize
44KB
-
memory/5028-135-0x0000000000400000-0x0000000002B6C000-memory.dmpFilesize
39.4MB
-
memory/5028-136-0x0000000004900000-0x000000000490D000-memory.dmpFilesize
52KB
-
memory/5028-139-0x0000000000400000-0x0000000002B6C000-memory.dmpFilesize
39.4MB