Analysis
-
max time kernel
119s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-02-2024 09:34
Behavioral task
behavioral1
Sample
a1882445b6e89bf1112354e22f3062c0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a1882445b6e89bf1112354e22f3062c0.exe
Resource
win10v2004-20240221-en
General
-
Target
a1882445b6e89bf1112354e22f3062c0.exe
-
Size
2.7MB
-
MD5
a1882445b6e89bf1112354e22f3062c0
-
SHA1
1c6cf8a64b32e255ba0616eb61967be0bf55f88f
-
SHA256
b7118f6cd74d92c5fd06cb11931c161d031e6bd0cfe121b91e831bf1d5ca64c7
-
SHA512
0562e8d8982bab35f3a5a46e509863622edd4d6dc11715e6c67b29f4bcc28f5ece7a88fde57ba4e851260634060369a43834ef6af3af2b3e8f6fa2139d93e9a0
-
SSDEEP
49152:C99FYePL9j9qwVoTD0Cn8AzTIPqkqIreD0nn7CZQdI5+SRVUMU3OJR/:C1j/ikC8AH1sewn2+SjLaOJR
Malware Config
Extracted
gozi
Signatures
-
Deletes itself 1 IoCs
Processes:
a1882445b6e89bf1112354e22f3062c0.exepid process 2088 a1882445b6e89bf1112354e22f3062c0.exe -
Executes dropped EXE 1 IoCs
Processes:
a1882445b6e89bf1112354e22f3062c0.exepid process 2088 a1882445b6e89bf1112354e22f3062c0.exe -
Loads dropped DLL 1 IoCs
Processes:
a1882445b6e89bf1112354e22f3062c0.exepid process 2744 a1882445b6e89bf1112354e22f3062c0.exe -
Processes:
resource yara_rule behavioral1/memory/2744-2-0x0000000000400000-0x000000000086A000-memory.dmp upx \Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exe upx behavioral1/memory/2088-17-0x0000000000400000-0x000000000086A000-memory.dmp upx behavioral1/memory/2744-15-0x0000000003690000-0x0000000003AFA000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
a1882445b6e89bf1112354e22f3062c0.exepid process 2744 a1882445b6e89bf1112354e22f3062c0.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
a1882445b6e89bf1112354e22f3062c0.exea1882445b6e89bf1112354e22f3062c0.exepid process 2744 a1882445b6e89bf1112354e22f3062c0.exe 2088 a1882445b6e89bf1112354e22f3062c0.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a1882445b6e89bf1112354e22f3062c0.exedescription pid process target process PID 2744 wrote to memory of 2088 2744 a1882445b6e89bf1112354e22f3062c0.exe a1882445b6e89bf1112354e22f3062c0.exe PID 2744 wrote to memory of 2088 2744 a1882445b6e89bf1112354e22f3062c0.exe a1882445b6e89bf1112354e22f3062c0.exe PID 2744 wrote to memory of 2088 2744 a1882445b6e89bf1112354e22f3062c0.exe a1882445b6e89bf1112354e22f3062c0.exe PID 2744 wrote to memory of 2088 2744 a1882445b6e89bf1112354e22f3062c0.exe a1882445b6e89bf1112354e22f3062c0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exe"C:\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exeC:\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exeFilesize
2.7MB
MD5bf6622176235ca27076c756ebc97e90a
SHA15e927646dc7d7e99969fd284a7166218dc0970f1
SHA256302527c042daf155629d2bef9d3681ebb74d2446d8cf9f02e5d14c34427a598c
SHA5128f880206ab5243d674cb82c2d2225303e53b0843ffee4d32b046ea7549bfe425098fb836346168ad46c1cdf2e2aa511973febe74fc36b7f553914acc1e524294
-
memory/2088-17-0x0000000000400000-0x000000000086A000-memory.dmpFilesize
4.4MB
-
memory/2088-18-0x0000000000130000-0x0000000000242000-memory.dmpFilesize
1.1MB
-
memory/2088-19-0x0000000000400000-0x00000000005F2000-memory.dmpFilesize
1.9MB
-
memory/2088-27-0x0000000000400000-0x000000000086A000-memory.dmpFilesize
4.4MB
-
memory/2744-0-0x0000000000400000-0x00000000005F2000-memory.dmpFilesize
1.9MB
-
memory/2744-2-0x0000000000400000-0x000000000086A000-memory.dmpFilesize
4.4MB
-
memory/2744-4-0x0000000001A60000-0x0000000001B72000-memory.dmpFilesize
1.1MB
-
memory/2744-15-0x0000000003690000-0x0000000003AFA000-memory.dmpFilesize
4.4MB
-
memory/2744-14-0x0000000000400000-0x00000000005F2000-memory.dmpFilesize
1.9MB
-
memory/2744-26-0x0000000003690000-0x0000000003AFA000-memory.dmpFilesize
4.4MB