Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-01-2024 11:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7fb81b98bb77b54c2f69ab7c19d8bc25.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
General
-
Target
7fb81b98bb77b54c2f69ab7c19d8bc25.dll
-
Size
605KB
-
MD5
7fb81b98bb77b54c2f69ab7c19d8bc25
-
SHA1
bfd82e8164088d905576f66f2010e5f1fb1e892f
-
SHA256
6700cc014e9ef5473a909a0c10d644661ccd0750ca942abd458cec91e32bf551
-
SHA512
6a42a3b31cdd34436f92f6eeb29e968a81cde00a69adcae8174231faa9bc7e9ec0f5d4a5f419591cb425ddff936f11a6493310f24f8f3ea83f3993e07996efb5
-
SSDEEP
12288:/edbxfx8d3fbkRXgeSVpZJosJe9ln3KuUliVjjP:/e3fYYRk/Xw9t3KniV
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
1001
C2
yahoo.com
bogoleruno.website
gogoleruno.website
Attributes
-
base_path
/gksadk/
-
build
250212
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
extension
.fre
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2336 wrote to memory of 2312 2336 rundll32.exe rundll32.exe PID 2336 wrote to memory of 2312 2336 rundll32.exe rundll32.exe PID 2336 wrote to memory of 2312 2336 rundll32.exe rundll32.exe PID 2336 wrote to memory of 2312 2336 rundll32.exe rundll32.exe PID 2336 wrote to memory of 2312 2336 rundll32.exe rundll32.exe PID 2336 wrote to memory of 2312 2336 rundll32.exe rundll32.exe PID 2336 wrote to memory of 2312 2336 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7fb81b98bb77b54c2f69ab7c19d8bc25.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7fb81b98bb77b54c2f69ab7c19d8bc25.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2312-0-0x0000000074680000-0x00000000747BB000-memory.dmpFilesize
1.2MB
-
memory/2312-1-0x0000000074680000-0x00000000747BB000-memory.dmpFilesize
1.2MB
-
memory/2312-2-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2312-3-0x0000000000160000-0x0000000000170000-memory.dmpFilesize
64KB
-
memory/2312-6-0x0000000074680000-0x00000000747BB000-memory.dmpFilesize
1.2MB