Analysis
- max time kernel
120s - max time network
127s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
26/04/2024, 00:44
General
- Target ItroublveTSC-master/bin/Binaries/RtkBtManServ.exe
- Size 2.8MB
- Sample240426-a3z2eage79
- SHA256 f4fb42c8312a6002a8783e2a1ab4571eb89e92cd192b1a21e8c4582205c37312
Score
10/10
Malware Config
Extracted
Family
-
gozi
Signatures
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Nirsoft 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ItroublveTSC-master\bin\Binaries\RtkBtManServ.exe"C:\Users\Admin\AppData\Local\Temp\ItroublveTSC-master\bin\Binaries\RtkBtManServ.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1640 -s 6042⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1640-0-0x0000000000390000-0x000000000066A000-memory.dmp
memory/1640-1-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp
memory/1640-2-0x000000001B6C0000-0x000000001BA02000-memory.dmp
memory/1640-3-0x0000000000240000-0x0000000000246000-memory.dmp
memory/1640-4-0x000000001B4A0000-0x000000001B520000-memory.dmp
memory/1640-5-0x0000000000890000-0x0000000000940000-memory.dmp
memory/1640-36-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp
memory/1640-37-0x000000001B4A0000-0x000000001B520000-memory.dmp