Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2023 10:05
Static task
static1
Behavioral task
behavioral1
Sample
client.exe
Resource
win7-20230831-en
General
-
Target
client.exe
-
Size
181KB
-
MD5
3f4f43c62a011f08bdfd132078c366f4
-
SHA1
ef5ac4d530df3c4fcad6ba26360c383765e87eb7
-
SHA256
31ce7210f050439db9dfb5d7998b1101834c8c7613942a6e73719d6c66bc7e32
-
SHA512
77121fba1d0a59b5747701fcfd326ff1f00fa6a5f6f748c598f756abb130fd638e597bb4c575a6d4852f9215066898ffeea8263eb028148bd59d4e6b9fa41f70
-
SSDEEP
3072:976c8IAr3ZskIrYKhSz3yTzZkmkOSc3xhmpafpKEp9ptl5lCUL6zp:pL89TKkcYNcDkqHyaBt3pL6zp
Malware Config
Extracted
gozi
Extracted
gozi
5050
46.8.210.250
31.41.44.9
185.247.184.139
62.72.33.155
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Signatures
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral2/memory/4288-1-0x0000000000DF0000-0x0000000000DFC000-memory.dmp dave -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 4112 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4112-14-0x0000026747D40000-0x0000026747D50000-memory.dmpFilesize
64KB
-
memory/4112-30-0x0000026747E40000-0x0000026747E50000-memory.dmpFilesize
64KB
-
memory/4112-46-0x0000026750180000-0x0000026750181000-memory.dmpFilesize
4KB
-
memory/4112-48-0x00000267501B0000-0x00000267501B1000-memory.dmpFilesize
4KB
-
memory/4112-49-0x00000267501B0000-0x00000267501B1000-memory.dmpFilesize
4KB
-
memory/4112-50-0x00000267502C0000-0x00000267502C1000-memory.dmpFilesize
4KB
-
memory/4288-1-0x0000000000DF0000-0x0000000000DFC000-memory.dmpFilesize
48KB
-
memory/4288-0-0x0000000000E00000-0x0000000000E0F000-memory.dmpFilesize
60KB
-
memory/4288-5-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/4288-11-0x0000000000E90000-0x0000000000E9D000-memory.dmpFilesize
52KB