Analysis
-
max time kernel
86s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2023 23:20
Static task
static1
Behavioral task
behavioral1
Sample
ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959.dll
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
General
-
Target
ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959.dll
-
Size
706KB
-
MD5
3b69cd2054a8234939a684ed60b7d671
-
SHA1
1e07e548668918d5db3c7b907ad765f2996ff5c5
-
SHA256
ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959
-
SHA512
717b6fa6fe5040474df92377f60918a8c029690cf62fcf6bbbce07e0eabbdfb649720e6a85973d64d1109747de3c2b4cd0f59885ade6e8068e3d6e2a56339b8e
-
SSDEEP
3072:XGMvz842hp4xCCIaBCpGkWSkx0cf5P0UGwS+9BNmA6a:Xtx2yBCiSkxPNT7Ya
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
1000
C2
https://ceredovza.top
Attributes
-
host_keep_time
2
-
host_shift_time
1
-
idle_time
1
-
request_time
10
aes.plain
Signatures
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac6a11ecf700dafee430abe06d62b96a2180f08b1b83b7128e2b9bcab1d67959.dll1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2680 -s 5442⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 176 -p 2680 -ip 26801⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2680-133-0x0000000180000000-0x0000000180014000-memory.dmpFilesize
80KB
-
memory/2680-137-0x00000000048B0000-0x00000000048C3000-memory.dmpFilesize
76KB
-
memory/2680-142-0x00000000015B0000-0x00000000015B1000-memory.dmpFilesize
4KB
-
memory/2680-143-0x0000000064880000-0x0000000064930000-memory.dmpFilesize
704KB