Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2024, 11:03 UTC

General

  • Target

    d21fc7e4912436c536c1bf752cf01910_JaffaCakes118.exe

  • Size

    269KB

  • MD5

    d21fc7e4912436c536c1bf752cf01910

  • SHA1

    48d3c0d50a40d301352ff594dec7f66e8e4653ad

  • SHA256

    5397ebcc73c4862206f10ba289543d745a051b1ec2331d81d36beaf5c5757a7a

  • SHA512

    f46074f31775c9c044d4d7bb363ae29ef1f743a777c30733757545d9fed56a6f0ad157a18d939a457f339732259c5527b5fdfc66a5509ded9086a667ae0d0301

  • SSDEEP

    6144:/qdA+91vlJiVFsi8mC/xoiOlb+XYhR3nAw2bRpRqbY:CdJjvlJ6bLC/KbsYGbRubY

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1015

C2

caibmqujcohnvtjrop.net

lgeywijneyke.us

puqcgfwgmftravot.com

itnnuubvifmaintg.com

rtsnysrusdtbh.net

Attributes
  • exe_type

    worker

  • server_id

    8

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJffUudCuZ6rfJO2jRb4C08JNarpC+fR
3
nO6K5mNsPT0Dd1Gve0cWQyX1UXafORKConDt9uGiqIZCf5F4TuT4+okCAwEAAQ==
4
-----END PUBLIC KEY-----
serpent.plain
1
5325689462GFMNEO

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Gozi family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d21fc7e4912436c536c1bf752cf01910_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d21fc7e4912436c536c1bf752cf01910_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Users\Admin\AppData\Local\Temp\d21fc7e4912436c536c1bf752cf01910_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d21fc7e4912436c536c1bf752cf01910_JaffaCakes118.exe
      2⤵
        PID:3284

    Network

    • flag-us
      DNS
      133.211.185.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.211.185.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      196.249.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.249.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      53.210.109.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      53.210.109.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      200.201.50.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      200.201.50.20.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      133.211.185.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      133.211.185.52.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      146 B
      144 B
      2
      1

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      196.249.167.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      196.249.167.52.in-addr.arpa

    • 8.8.8.8:53
      53.210.109.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      53.210.109.20.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      200.201.50.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      200.201.50.20.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2788-0-0x00000000005D0000-0x00000000005D4000-memory.dmp

      Filesize

      16KB

    • memory/3284-1-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/3284-2-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/3284-3-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.