Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
18/07/2023, 16:33
General
- Target 3939.dll
- Size 803KB
- Sample230718-t2hkhsda7x
- SHA256 f08827fd5dba2f6ffda8f931b5f2e1c18012b74ed753ea76a0a511e095eb1648
Score
10/10
Malware Config
Extracted
Family
-
gozi
Extracted
Family
-
gozi
Botnet
-
20000
C2
-
http://45.11.182.38
-
http://79.132.130.230
-
https://listwhfite.check3.yaho1o.com
-
https://lisfwhite.ch2eck.yaheoo.com
-
http://45.155.250.58
-
https://liset.che3ck.bi1ng.com
-
http://45.155.249.91
Attributes
-
base_path
/zerotohero/
-
build
250260
-
exe_type
loader
-
extension
.asi
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Blocklisted process makes network request 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3939.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3939.dll,#12⤵
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3932-133-0x0000000002A10000-0x0000000002A51000-memory.dmp
memory/3932-134-0x00000000029D0000-0x00000000029DE000-memory.dmp
memory/3932-135-0x00000000029F0000-0x00000000029FD000-memory.dmp
memory/3932-138-0x0000000002A10000-0x0000000002A51000-memory.dmp
memory/3932-139-0x00000000029D0000-0x00000000029DE000-memory.dmp