Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28-08-2023 18:46
Static task
static1
Behavioral task
behavioral1
Sample
eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe
Resource
win7-20230712-en
General
-
Target
eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe
-
Size
469KB
-
MD5
53253db5ff9d00f85d2dfd6f3a25fb62
-
SHA1
71a72beaae92a83a5912a4cb2af301259e15473b
-
SHA256
eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66
-
SHA512
f84be54a85f6224bb2d89cda98ca67ef59622d24a40162b36518ac71352184616c531551c7b4a73479eafbbdeeae7bce590647e3c381badbad3a008ba6a5214a
-
SSDEEP
6144:qdjkmnzdHALJUif3wgYzhNBXGoAKvxOnbOhUQOahb6Wfdu5g8kRC:qPzdIeiPwX1NBXGAabO5NgWfST
Malware Config
Extracted
gozi
Extracted
gozi
6000
config.edge.skype.com
onlinetwork.top
linetwork.top
mmmmmm.bar
-
base_path
/drew/
-
build
250246
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exedescription pid process target process PID 1076 set thread context of 1764 1076 eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exepid process 1076 eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exedescription pid process target process PID 1076 wrote to memory of 1764 1076 eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe PID 1076 wrote to memory of 1764 1076 eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe PID 1076 wrote to memory of 1764 1076 eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe PID 1076 wrote to memory of 1764 1076 eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe PID 1076 wrote to memory of 1764 1076 eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe"C:\Users\Admin\AppData\Local\Temp\eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe"C:\Users\Admin\AppData\Local\Temp\eb16b6665115b8823a47c6cf2e61405459c7460f80011aa0fe24fef59dd29a66.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1076-0-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1076-1-0x0000000010000000-0x0000000010010000-memory.dmpFilesize
64KB
-
memory/1764-5-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1764-7-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1764-8-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1764-9-0x0000000000030000-0x000000000003D000-memory.dmpFilesize
52KB
-
memory/1764-12-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1764-13-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB