Analysis
-
max time kernel
55s -
max time network
62s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 02:20
Static task
static1
Behavioral task
behavioral1
Sample
244fcb71c16ab8163f25c633dcb91b1c.dll
Resource
win7-20231215-en
General
-
Target
244fcb71c16ab8163f25c633dcb91b1c.dll
-
Size
355KB
-
MD5
244fcb71c16ab8163f25c633dcb91b1c
-
SHA1
cf0256c44be6b311558358bb00f9ec257ec90236
-
SHA256
48589e8612584c5b67c325367e53b63379dbf984a0a0dc905bd29fd3f7fd6c03
-
SHA512
8768bcda747665ef22c4ca8208c43ade6397f7792a6b32a8ce37f7630513a684b7c3ab69620d5a74350f00e74ba72393f6ba08cec988172d5e0552161814d5cb
-
SSDEEP
6144:BstpyZ+ANKFOVwmBfjdLz5kazt+x1gLY3TGAa7VGpwCu:BstpbAmOOmljdLGeZOGH7Cu
Malware Config
Extracted
gozi
Extracted
gozi
1500
gtr.antoinfer.com
app.bighomegl.at
-
build
250204
-
exe_type
loader
-
server_id
580
Signatures
-
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3896 wrote to memory of 960 3896 rundll32.exe rundll32.exe PID 3896 wrote to memory of 960 3896 rundll32.exe rundll32.exe PID 3896 wrote to memory of 960 3896 rundll32.exe rundll32.exe
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\244fcb71c16ab8163f25c633dcb91b1c.dll,#11⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\244fcb71c16ab8163f25c633dcb91b1c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5028 CREDAT:17410 /prefetch:22⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:17410 /prefetch:22⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1896 CREDAT:17410 /prefetch:22⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\~DF278F25C1EC62D316.TMPFilesize
16KB
MD525b77277f0432fb6442c7baa88b1d708
SHA18f2ef1fecc4d6575e915bd7ecbdbeda4bb2bebcb
SHA25672d290c8151bb43c2da3d29777e85ba0980d5ac26a00fbaeb1e2ba6810a2dde5
SHA51231bf552f65b784cf0603ab88fc68023a0559d5fd11686fb84de7f9dce58d2cb03c429969699d9c4a46ed2960589217f59cd5667614df6e1f00e145b8afb724c5
-
memory/960-2-0x0000000000840000-0x0000000000841000-memory.dmpFilesize
4KB
-
memory/960-1-0x00000000748C0000-0x00000000749B4000-memory.dmpFilesize
976KB
-
memory/960-0-0x00000000748C0000-0x00000000749B4000-memory.dmpFilesize
976KB
-
memory/960-3-0x00000000748C0000-0x00000000749B4000-memory.dmpFilesize
976KB
-
memory/960-4-0x00000000748C0000-0x00000000749B4000-memory.dmpFilesize
976KB
-
memory/960-6-0x00000000748C0000-0x00000000749B4000-memory.dmpFilesize
976KB
-
memory/960-5-0x00000000748C0000-0x00000000749B4000-memory.dmpFilesize
976KB
-
memory/960-7-0x0000000002360000-0x000000000236D000-memory.dmpFilesize
52KB
-
memory/960-10-0x00000000748C0000-0x00000000749B4000-memory.dmpFilesize
976KB