Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-04-2024 05:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dce10e2eaf5ff6675f79dafc870da0cd_JaffaCakes118.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
-
Target
dce10e2eaf5ff6675f79dafc870da0cd_JaffaCakes118.dll
-
Size
606KB
-
MD5
dce10e2eaf5ff6675f79dafc870da0cd
-
SHA1
7bcb07ecca4b540c17b4a9a6192b78d2212c117d
-
SHA256
5c0d5dbdcefeb286689dc07a6a0a405a491e1ccb31cf4b945a245370ace5747a
-
SHA512
d9197778e5d0a766defc504178666d384678893b85a69712df9aa3b7c379f4f0c570afd3246c817640cec9d149cf0a49cc2682ca627d1cb98ec193057f1ed869
-
SSDEEP
12288:/8dajLSIFcqRfyo4Tf89UtoM+YD3h0QYDpnynKZ0febiL+eMq6FiIaRzrg:Roqpyo4TfmUtoMapy60feKQiI4
Malware Config
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
5566
C2
outlook.com
peajame.com
gderrrpololo.net
Attributes
-
base_path
/glik/
-
build
250211
-
dga_season
10
-
exe_type
loader
-
extension
.lwe
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1788 wrote to memory of 2668 1788 rundll32.exe rundll32.exe PID 1788 wrote to memory of 2668 1788 rundll32.exe rundll32.exe PID 1788 wrote to memory of 2668 1788 rundll32.exe rundll32.exe PID 1788 wrote to memory of 2668 1788 rundll32.exe rundll32.exe PID 1788 wrote to memory of 2668 1788 rundll32.exe rundll32.exe PID 1788 wrote to memory of 2668 1788 rundll32.exe rundll32.exe PID 1788 wrote to memory of 2668 1788 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dce10e2eaf5ff6675f79dafc870da0cd_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dce10e2eaf5ff6675f79dafc870da0cd_JaffaCakes118.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2668-0-0x00000000749B0000-0x0000000074AEB000-memory.dmpFilesize
1.2MB
-
memory/2668-2-0x00000000749B0000-0x0000000074AEB000-memory.dmpFilesize
1.2MB
-
memory/2668-3-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2668-4-0x0000000000230000-0x0000000000240000-memory.dmpFilesize
64KB
-
memory/2668-7-0x00000000749B0000-0x0000000074AEB000-memory.dmpFilesize
1.2MB