Behavioral task
behavioral1
Sample
4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794N.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794N.dll
Resource
win10v2004-20241007-en
General
-
Target
4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794N
-
Size
193KB
-
MD5
991f43cff60cc7c7f0fd272540b1bce0
-
SHA1
852b9190d6e7049857fa1e217a7b08878c4eaef3
-
SHA256
4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794
-
SHA512
92a576300023da8d2ddbed3b2434e97ec0cc70d4ee463d765f16516ffdb26178d5cde3c3628b9c344cb2b2a92ca1ee68ad9a6133f5b9eda8756761d591022933
-
SSDEEP
6144:CO9uHzMxo0REaK4uodHqSRqlalq+dnBLzjw:FuHIxoHas4qsqglq+dW
Malware Config
Extracted
gozi
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794N
Files
-
4e2c68509f3117edfc3a403db0e3e39cbd6da25e3acc3e96d37e8fb9bb3d5794N.dll windows:5 windows x86 arch:x86
730c9891010f983512da088ad738a3be
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
sprintf
ZwQueryInformationToken
ZwOpenProcess
ZwClose
ZwOpenProcessToken
strcpy
ZwQueryInformationProcess
RtlNtStatusToDosError
NtQuerySystemInformation
wcscmp
wcsncmp
wcslen
strstr
strlen
NtMapViewOfSection
memcpy
_snprintf
_wcsupr
_strupr
memmove
wcscpy
memset
ZwQueryKey
RtlFreeUnicodeString
RtlUpcaseUnicodeString
wcstombs
RtlImageNtHeader
RtlAdjustPrivilege
mbstowcs
NtUnmapViewOfSection
NtCreateSection
wcscat
_aulldiv
_allmul
_alldiv
_chkstk
RtlUnwind
NtQueryVirtualMemory
kernel32
QueueUserAPC
SetFilePointerEx
QueueUserWorkItem
FileTimeToLocalFileTime
VirtualProtectEx
GetComputerNameW
SystemTimeToFileTime
GetFileTime
FindNextFileA
FindFirstFileA
CompareFileTime
ExpandEnvironmentStringsA
QueryPerformanceFrequency
GetModuleFileNameA
GetLocalTime
GetModuleFileNameW
CreateFileA
lstrlenA
HeapAlloc
HeapFree
WriteFile
lstrcatA
CreateDirectoryA
GetLastError
RemoveDirectoryA
LoadLibraryA
CloseHandle
DeleteFileA
lstrcpyA
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
SetEvent
GetTickCount
HeapDestroy
HeapCreate
SetWaitableTimer
CreateDirectoryW
WaitForSingleObject
GetCurrentThread
GetSystemTimeAsFileTime
GetWindowsDirectoryA
OpenProcess
Sleep
CopyFileW
CreateEventA
CreateFileW
lstrlenW
InterlockedExchange
lstrcmpiW
GetModuleHandleA
lstrcatW
GetCurrentThreadId
DuplicateHandle
DeleteFileW
GetTempPathA
SuspendThread
ResumeThread
lstrcpyW
CreateThread
SwitchToThread
lstrcmpA
MapViewOfFile
UnmapViewOfFile
LeaveCriticalSection
SetLastError
lstrcmpiA
EnterCriticalSection
ResetEvent
OpenWaitableTimerA
OpenMutexA
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
GetVersionExA
CreateWaitableTimerA
InitializeCriticalSection
UnregisterWait
TlsGetValue
LoadLibraryExW
TlsSetValue
VirtualAlloc
RegisterWaitForSingleObject
VirtualProtect
TlsAlloc
GetProcAddress
GetFileSize
GetDriveTypeW
GetLogicalDriveStringsW
WideCharToMultiByte
GetExitCodeProcess
CreateProcessA
CreateFileMappingA
OpenFileMappingA
LocalFree
lstrcpynA
GlobalLock
GlobalUnlock
Thread32First
Thread32Next
FileTimeToSystemTime
OpenThread
CreateToolhelp32Snapshot
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetSystemTime
RemoveVectoredExceptionHandler
SleepEx
AddVectoredExceptionHandler
OpenEventA
LocalAlloc
FreeLibrary
RaiseException
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetVersion
DeleteCriticalSection
RemoveDirectoryW
FindClose
GetTempFileNameA
GetFileAttributesW
SetEndOfFile
SetFilePointer
ExpandEnvironmentStringsW
FindNextFileW
LoadLibraryW
SetEnvironmentVariableW
FindFirstFileW
GetEnvironmentVariableW
GetCommandLineW
ExitProcess
oleaut32
VariantInit
VariantClear
SysAllocString
SysFreeString
Sections
.text Size: 150KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ