Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2023 06:08
Static task
static1
Behavioral task
behavioral1
Sample
client.exe
Resource
win7-20230831-en
General
-
Target
client.exe
-
Size
230KB
-
MD5
a79e4eb10421a51f959dbfab392085fa
-
SHA1
315a5353b418a066ea5c6c44faf25eac55c81be6
-
SHA256
6ac7ce03310cde657eec90facfa67bc6c878a413c462858fc671c1e8acc670f3
-
SHA512
1417ed6cc0b8c41c31ada8136951a52df6a43512c39333be4b5044072f0806018a11ae9b22687a46c237e762a653f903e37f4c40e5fb3ddf83a0bdfed38c4023
-
SSDEEP
3072:JtFok3nTwth5eKvu+95JG3D9TcUonLpq1/xE02WKteBczMCLVIr4upCe7CelPg9:3FjnEtHe8ubzbWdOGWKtNVmX/Zg9
Malware Config
Extracted
gozi
Extracted
gozi
5050
46.8.210.250
31.41.44.9
185.247.184.139
62.72.33.155
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Signatures
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral2/memory/1452-1-0x00000000013D0000-0x00000000013DC000-memory.dmp dave -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 2792 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1452-0-0x00000000014F0000-0x00000000014FF000-memory.dmpFilesize
60KB
-
memory/1452-1-0x00000000013D0000-0x00000000013DC000-memory.dmpFilesize
48KB
-
memory/1452-5-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1452-11-0x0000000001520000-0x000000000152D000-memory.dmpFilesize
52KB
-
memory/2792-14-0x000001B1A7940000-0x000001B1A7950000-memory.dmpFilesize
64KB
-
memory/2792-30-0x000001B1A7A40000-0x000001B1A7A50000-memory.dmpFilesize
64KB
-
memory/2792-46-0x000001B1AFD30000-0x000001B1AFD31000-memory.dmpFilesize
4KB
-
memory/2792-48-0x000001B1AFD60000-0x000001B1AFD61000-memory.dmpFilesize
4KB
-
memory/2792-49-0x000001B1AFD60000-0x000001B1AFD61000-memory.dmpFilesize
4KB
-
memory/2792-50-0x000001B1AFE70000-0x000001B1AFE71000-memory.dmpFilesize
4KB