Behavioral task
behavioral1
Sample
2744-69-0x0000000006A00000-0x0000000007283000-memory.exe
Resource
win7-20240903-en
General
-
Target
2744-69-0x0000000006A00000-0x0000000007283000-memory.dmp
-
Size
8.5MB
-
MD5
132f3fa63619e033f0d4a3edef5b2881
-
SHA1
03245bef60d805c52d9ba0ae7b4d0298977fa10f
-
SHA256
61096a697287d66ad1e69cec5453d4e33990e23a27128c439a9d1db624db35dc
-
SHA512
a2803e3b71bc1137d3dab74ff4e609d8a12e2499b234ee80a4ee4f72c5fa181e8f7d205e08d034b72b80bc04c39208b535239ebd850d51cb0481a67fda5ee1c7
-
SSDEEP
98304:ot1e0paAJJZDlLWJQgJzt6d3Bzt6It1e0pa4JJZDlLWJQ3Bzt6RZDlLWJm:o5gRt6d3Jt6IZ3Jt6P
Malware Config
Extracted
gozi
Signatures
Files
-
2744-69-0x0000000006A00000-0x0000000007283000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 416KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jmwtliwt Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bnhsjhus Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE