Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 14:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
modulo.dll
Resource
win7-20230831-en
windows7-x64
2 signatures
150 seconds
General
-
Target
modulo.dll
-
Size
206KB
-
MD5
72e2a5c797954e895a41be5b20f867b2
-
SHA1
419aacfb3ccea9b08277bcc9405054fa4238a597
-
SHA256
858d867cc62c0bf13b16ccdb9f6cd6022d61fc2ab98a7db60806a35c7da9b2e0
-
SHA512
77be53cf579f69ee728fafbe93568b8d4c462490ba3fe053db367798508abb0d7a838731d17e465f0a29b982eb49e1227d94c971823e1d375b2b761887e107b3
-
SSDEEP
6144:sMmIE7vr+qWNGzfXDanCU60rPP+vJsWKq12Jy:o/7DrQGzfXDeCU6cevKWXwy
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5050
C2
fotexion.com
Attributes
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2984 wrote to memory of 2084 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 2084 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 2084 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 2084 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 2084 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 2084 2984 rundll32.exe rundll32.exe PID 2984 wrote to memory of 2084 2984 rundll32.exe rundll32.exe