Analysis
-
max time kernel
142s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-03-2024 12:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b77316676d9f3237a0c9877f170bd7bc.dll
Resource
win7-20240221-en
2 signatures
150 seconds
General
-
Target
b77316676d9f3237a0c9877f170bd7bc.dll
-
Size
234KB
-
MD5
b77316676d9f3237a0c9877f170bd7bc
-
SHA1
b2cb7352606b13e3459b540edc0d284e0c31e333
-
SHA256
d1b9f842f386bc75e77f81d72687ecc2f4041ddd097f76d8c096d11822f07667
-
SHA512
58eb50d58996bc230a1e424043a9e69aa37b21872469b41865a3073196c0e9a32405c0e35fa151a9ebace2017c40318aab870cc4b945f3764caa2366ae47981d
-
SSDEEP
3072:hE3L0WE+9HEb9mMhLTaWTuNua4VRTaH3QJZn7A1dnaSXPvumBryi9KQ5KSAsK87a:a3LxNgPhLTqr4f2HgJR72Z/vxB39L+r
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
2500
C2
gtr.antoinfer.com
app.bighomegl.at
Attributes
-
build
250211
-
exe_type
loader
-
server_id
580
rsa_pubkey.plain
aes.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2164 wrote to memory of 1864 2164 rundll32.exe 28 PID 2164 wrote to memory of 1864 2164 rundll32.exe 28 PID 2164 wrote to memory of 1864 2164 rundll32.exe 28 PID 2164 wrote to memory of 1864 2164 rundll32.exe 28 PID 2164 wrote to memory of 1864 2164 rundll32.exe 28 PID 2164 wrote to memory of 1864 2164 rundll32.exe 28 PID 2164 wrote to memory of 1864 2164 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b77316676d9f3237a0c9877f170bd7bc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b77316676d9f3237a0c9877f170bd7bc.dll,#12⤵PID:1864
-