Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2024 05:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ed40ad3a1cde5271687f5f9baad73ab.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
General
-
Target
6ed40ad3a1cde5271687f5f9baad73ab.dll
-
Size
520KB
-
MD5
6ed40ad3a1cde5271687f5f9baad73ab
-
SHA1
1bbd961e12e374780d95d9bb0986c49488cdf788
-
SHA256
f7b13b86ffef13feb5f3e6f01bf5aec3e333ecfbfeb43dcce22e9ba5cd53f0a9
-
SHA512
08ce35e6bfac42004057acb6a913417e2435d045b8d214160f56fa600a317535a9882ff7a28d2498a15ef81354f1da460a033725691221835762d2885de2b22f
-
SSDEEP
12288:0/1dF5oiiOpCp1wwMnJPLHD/4M1kPD7KrY4Zk1Af0fSlllll/lllllj1OrvhcGX:0/h5aOwI1HcR7P4m1AESlllll/lllll0
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
1500
C2
gtr.antoinfer.com
app.bighomegl.at
Attributes
-
build
250211
-
exe_type
loader
-
server_id
580
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1372 wrote to memory of 1028 1372 rundll32.exe rundll32.exe PID 1372 wrote to memory of 1028 1372 rundll32.exe rundll32.exe PID 1372 wrote to memory of 1028 1372 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6ed40ad3a1cde5271687f5f9baad73ab.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6ed40ad3a1cde5271687f5f9baad73ab.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1028-0-0x0000000010000000-0x0000000010116000-memory.dmpFilesize
1.1MB
-
memory/1028-1-0x0000000010000000-0x0000000010116000-memory.dmpFilesize
1.1MB
-
memory/1028-2-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB
-
memory/1028-3-0x0000000010000000-0x0000000010116000-memory.dmpFilesize
1.1MB
-
memory/1028-4-0x0000000002B30000-0x0000000002B3D000-memory.dmpFilesize
52KB
-
memory/1028-7-0x0000000010000000-0x0000000010116000-memory.dmpFilesize
1.1MB