Behavioral task
behavioral1
Sample
cf043012ad2be371b8f945ac4952f79d9484f74d8e5fe9a08970d0df748927ab.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
cf043012ad2be371b8f945ac4952f79d9484f74d8e5fe9a08970d0df748927ab.dll
Resource
win10v2004-20230915-en
General
-
Target
12146133222.zip
-
Size
132KB
-
MD5
ca62fc5bf349f31049685cfd363666e1
-
SHA1
7f3bd836191fce423caffabf2173bb7d0f1dc83d
-
SHA256
2308e6d718e12ec988f6d6e159904cba0a7ba4889cbfb4dcb78b1e3f496faa4a
-
SHA512
be83698c8e66c01cd2fb66ff58c81091ae23e793d2e9d05da5a9bea51cc224e76fc6c83e3848f242c7f8238d17e53b0426787ad285ccdc84f66bfcc4e8d6cba7
-
SSDEEP
3072:6pnhPOt8C8iY0Ij9Dag8B2Eb14rE5vHluMrCvw+TEDD7F:ulS8C8i9IjEpuEhHZrCI+TEh
Malware Config
Extracted
gozi
2000
trackingg2-protectioon.cdn4.mozilla.net
109.230.199.185
trackingg3-protectioon.cdn5.mozilla.net
185.212.44.249
trackingg4-protectioon.cdn5.mozilla.net
194.76.225.37
trackingg5-protectioon.cdn1.mozilla.net
194.76.224.181
trackingg-protectioon.cdn1.mozilla.net
194.76.225.164
trackingg3-protectioon.cdn6.mozilla.net
185.158.251.205
trackingg-protectioon.cdn2.mozilla.net
185.189.149.216
trackingg5-protectioon.cdn3.mozilla.net
185.158.249.54
trackingg-protectioon.cdn4.mozilla.net
185.212.44.130
trackingg1-protectioon.cdn5.mozilla.net
37.10.71.83
trackinggs-trackingg-protectioon.cdn4.mozilla.net
trackingg-protectioon.cdn5.mozilla.net
-
base_path
/fonts/
-
exe_type
worker
-
extension
.bak
-
server_id
50
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/cf043012ad2be371b8f945ac4952f79d9484f74d8e5fe9a08970d0df748927ab
Files
-
12146133222.zip.zip
Password: infected
-
cf043012ad2be371b8f945ac4952f79d9484f74d8e5fe9a08970d0df748927ab.dll windows:5 windows x64
Password: infected
81de4ee1071a8320787d7c9e149ace7f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ZwOpenProcess
ZwQueryInformationToken
NtSetInformationProcess
sprintf
ZwOpenProcessToken
strcpy
ZwQueryInformationProcess
RtlNtStatusToDosError
NtQuerySystemInformation
NtQueryInformationThread
_wcsupr
memmove
wcscpy
_snprintf
mbstowcs
ZwQueryKey
NtResumeProcess
RtlFreeUnicodeString
RtlUpcaseUnicodeString
NtSuspendProcess
wcstombs
RtlAdjustPrivilege
memset
_strupr
_snwprintf
memcpy
RtlImageNtHeader
ZwClose
__C_specific_handler
__chkstk
RegisterWaitForSingleObject
VirtualProtectEx
FileTimeToLocalFileTime
CreateFileMappingW
GetModuleFileNameA
GetModuleFileNameW
QueryPerformanceFrequency
GetLocalTime
FileTimeToSystemTime
GetComputerNameExA
GetComputerNameW
QueryPerformanceCounter
GetTempFileNameA
CreateThread
TerminateThread
GetCurrentProcessId
GetVersion
DeleteCriticalSection
HeapAlloc
HeapFree
WaitForSingleObject
ExitThread
lstrlenW
GetLastError
ResetEvent
CloseHandle
DeleteFileW
CreateFileA
lstrlenA
WriteFile
lstrcatA
CreateDirectoryA
RemoveDirectoryA
LoadLibraryA
DeleteFileA
lstrcpyA
HeapReAlloc
SetEvent
GetSystemTimeAsFileTime
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetFileSize
lstrcmpA
SetWaitableTimer
CreateDirectoryW
GetTickCount
GetCurrentThread
VirtualFree
GetWindowsDirectoryA
GetCommandLineA
InitializeCriticalSection
OpenProcess
Sleep
CopyFileW
CreateEventA
LeaveCriticalSection
TerminateProcess
CreateFileW
VirtualAlloc
EnterCriticalSection
lstrcmpiW
lstrcatW
GetCurrentThreadId
DuplicateHandle
GetTempPathA
SuspendThread
ResumeThread
lstrcpyW
SwitchToThread
MapViewOfFile
UnmapViewOfFile
SetLastError
lstrcmpiA
OpenWaitableTimerA
OpenMutexA
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
CreateWaitableTimerA
UnregisterWait
TlsGetValue
LoadLibraryExW
TlsSetValue
VirtualQuery
VirtualProtect
TlsAlloc
GetProcAddress
OpenEventA
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetDriveTypeW
GetLogicalDriveStringsW
WideCharToMultiByte
GetExitCodeProcess
CreateProcessA
CreateFileMappingA
OpenFileMappingA
LocalFree
lstrcpynA
GlobalLock
GlobalUnlock
Thread32First
Thread32Next
QueueUserAPC
OpenThread
CreateToolhelp32Snapshot
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetSystemTime
SleepEx
LocalAlloc
FreeLibrary
RaiseException
ExpandEnvironmentStringsW
RemoveDirectoryW
SetEndOfFile
SetFilePointer
FindNextFileW
FindClose
GetFileAttributesW
SetFilePointerEx
FindFirstFileW
GetVersionExA
Sections
.text Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ