Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14-02-2024 08:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b40d3ed02b3662db4e286a7d09f134a.dll
Resource
win7-20231215-en
2 signatures
150 seconds
General
-
Target
9b40d3ed02b3662db4e286a7d09f134a.dll
-
Size
520KB
-
MD5
9b40d3ed02b3662db4e286a7d09f134a
-
SHA1
1787247bfdce33a4a0126b167317ee814a165c4d
-
SHA256
d43cfc2d0658951ce6118d1c851abe9bc4cad91b4e5732fad998cb53e034d858
-
SHA512
3c17e3cdd6f294b3deedb0d1b8f8302fe6e346ca7285361eabc26168fe030056143246e35a484e1d7956a1f424bcdea8be3bb9163044ecc71ac013a4ad55c85f
-
SSDEEP
12288:0/1dF5oiiOpCp1wwMnJiLHD/4M1kPD7KrY4Zk1Af0fSlllll/lllllj1OrvhcGX:0/h5aOwIgHcR7P4m1AESlllll/lllll0
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
1500
C2
gtr.antoinfer.com
app.bighomegl.at
Attributes
-
build
250211
-
exe_type
loader
-
server_id
580
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2548 wrote to memory of 3056 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 3056 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 3056 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 3056 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 3056 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 3056 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 3056 2548 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b40d3ed02b3662db4e286a7d09f134a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b40d3ed02b3662db4e286a7d09f134a.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3056-0-0x0000000010000000-0x0000000010116000-memory.dmpFilesize
1.1MB
-
memory/3056-1-0x0000000010000000-0x0000000010116000-memory.dmpFilesize
1.1MB
-
memory/3056-2-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/3056-3-0x0000000000310000-0x000000000031D000-memory.dmpFilesize
52KB
-
memory/3056-6-0x0000000010000000-0x0000000010116000-memory.dmpFilesize
1.1MB