Analysis
- max time kernel
153s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
15/03/2024, 13:22
General
- Target main.php.dll
- Size 442KB
- Sample240315-ql79fshc2t
- SHA256 b54dc5193824eb35233c3922687a5adc462ab474362dd4effd488c2ae0dae301
Score
10/10
Malware Config
Extracted
Family
-
gozi
Extracted
Family
-
gozi
Botnet
-
3500
C2
-
init.icecreambob.com
-
app.updatebrouser.com
-
fun.lakeofgold.com
Attributes
-
build
250211
-
exe_type
loader
-
server_id
580
rsa_pubkey.plain
aes.plain
Signatures
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\main.php.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\main.php.dll,#12⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2840-0-0x0000000075580000-0x000000007568D000-memory.dmp
memory/2840-1-0x0000000075580000-0x000000007568D000-memory.dmp
memory/2840-3-0x0000000075580000-0x000000007568D000-memory.dmp
memory/2840-2-0x0000000002350000-0x0000000002351000-memory.dmp
memory/2840-4-0x0000000075580000-0x000000007568D000-memory.dmp
memory/2840-5-0x0000000002CF0000-0x0000000002CFD000-memory.dmp
memory/2840-8-0x0000000075580000-0x000000007568D000-memory.dmp
memory/2840-10-0x0000000002350000-0x0000000002351000-memory.dmp