Analysis

  • max time kernel
    143s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2024 19:31

General

  • Target

    04d6963ab02c1f483cb9ff7af68c15456740099de5dd84dc68a77e9511772129.dll

  • Size

    761KB

  • MD5

    daacc7852627bd0e71b8e3d2a4a6543b

  • SHA1

    f47462d2b9d2b375684f98f011e399c25fe2e7dd

  • SHA256

    04d6963ab02c1f483cb9ff7af68c15456740099de5dd84dc68a77e9511772129

  • SHA512

    4c6fe5679e123443c3ec19094683ba834dbec0515b56bcde43c33d423db2684b108d6f9c457c9c10daa4765054c7d8bdc163b59a2c75464c42d7bcb6a18b2cd8

  • SSDEEP

    12288:JauX9Io7goxCqOJC0g+j4gBoB3KD/KZExnbCZwcSeVX6OF+XN15xJgiC42D6r3ec:Jah7oYJRrLDSZExnbCvSyF+XW/6T

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1000

C2

http://ey7kuuklgieop2pq.onion

http://maiamirainy.at

http://drunt.at

http://news-deck.at

Attributes
  • build

    216098

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Gozi family
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\04d6963ab02c1f483cb9ff7af68c15456740099de5dd84dc68a77e9511772129.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\04d6963ab02c1f483cb9ff7af68c15456740099de5dd84dc68a77e9511772129.dll,#1
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2304
        • C:\Windows\system32\control.exe
          C:\Windows\system32\control.exe /?
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL /?
            5⤵
              PID:2828
      • C:\Windows\system32\cmd.exe
        cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\7778.bi1"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Windows\system32\nslookup.exe
          nslookup myip.opendns.com resolver1.opendns.com
          3⤵
            PID:1368
        • C:\Windows\system32\cmd.exe
          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\7778.bi1"
          2⤵
            PID:1668
          • C:\Windows\syswow64\cmd.exe
            "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1380

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\7778.bi1

          Filesize

          111B

          MD5

          272152899894b1573c536b5eedafad3f

          SHA1

          ba73996145ff8521f1e28543c07d6b73455eef0a

          SHA256

          60aed64d0f599344e2e13e8583580170ab2b8a367830be8d0fff1fc194f476c8

          SHA512

          d7df8c91738793b70b9ef7719ad0ec3dc9c9e3c25cfe57abaafac6d6f3ceb2ab21ffe9663e10b81694a42b62529fe364588930af2dfed61e5e81c89f31b02ee7

        • C:\Users\Admin\AppData\Local\Temp\7778.bi1

          Filesize

          122B

          MD5

          4e722b4828cea8a135eb7a2bfd92ab01

          SHA1

          8e1abee672a878fd9c1d33e242502205d9b2da55

          SHA256

          c4d1feacbfb9ecd1a24e9b6d3e51fc7e9797da543d319f43ff0917db4c1e5e02

          SHA512

          88c0d6b07d45f906164b2c1178a938ffb56c4fa7288853a02f460339bca026fa58b26a37f52ea846bc205e1828f12f0361d1b0425a1106c8b1a947856d4ee4e4

        • C:\Users\Admin\AppData\Roaming\Microsoft\Dmdlsitf\bitsPQEC.dll

          Filesize

          761KB

          MD5

          daacc7852627bd0e71b8e3d2a4a6543b

          SHA1

          f47462d2b9d2b375684f98f011e399c25fe2e7dd

          SHA256

          04d6963ab02c1f483cb9ff7af68c15456740099de5dd84dc68a77e9511772129

          SHA512

          4c6fe5679e123443c3ec19094683ba834dbec0515b56bcde43c33d423db2684b108d6f9c457c9c10daa4765054c7d8bdc163b59a2c75464c42d7bcb6a18b2cd8

        • memory/1216-37-0x00000000063F0000-0x00000000064A4000-memory.dmp

          Filesize

          720KB

        • memory/1216-23-0x00000000063F0000-0x00000000064A4000-memory.dmp

          Filesize

          720KB

        • memory/1216-30-0x00000000063F0000-0x00000000064A4000-memory.dmp

          Filesize

          720KB

        • memory/1216-29-0x00000000025D0000-0x00000000025D1000-memory.dmp

          Filesize

          4KB

        • memory/1380-42-0x00000000002C0000-0x0000000000367000-memory.dmp

          Filesize

          668KB

        • memory/2112-20-0x0000000001BE0000-0x0000000001C94000-memory.dmp

          Filesize

          720KB

        • memory/2112-15-0x0000000001BE0000-0x0000000001C94000-memory.dmp

          Filesize

          720KB

        • memory/2112-36-0x0000000001BE0000-0x0000000001C94000-memory.dmp

          Filesize

          720KB

        • memory/2112-19-0x00000000000E0000-0x00000000000E1000-memory.dmp

          Filesize

          4KB

        • memory/2112-13-0x000007FFFFFD9000-0x000007FFFFFDA000-memory.dmp

          Filesize

          4KB

        • memory/2304-14-0x0000000072FF9000-0x0000000072FFC000-memory.dmp

          Filesize

          12KB

        • memory/2304-22-0x0000000072F40000-0x000000007390E000-memory.dmp

          Filesize

          9.8MB

        • memory/2304-11-0x00000000001E0000-0x000000000022A000-memory.dmp

          Filesize

          296KB

        • memory/2304-0-0x0000000072FF9000-0x0000000072FFC000-memory.dmp

          Filesize

          12KB

        • memory/2304-4-0x00000000001E0000-0x000000000022A000-memory.dmp

          Filesize

          296KB

        • memory/2304-3-0x0000000072F40000-0x000000007390E000-memory.dmp

          Filesize

          9.8MB

        • memory/2304-2-0x0000000072F40000-0x000000007390E000-memory.dmp

          Filesize

          9.8MB

        • memory/2304-1-0x0000000072F40000-0x000000007390E000-memory.dmp

          Filesize

          9.8MB

        • memory/2828-31-0x000007FFFFFDB000-0x000007FFFFFDC000-memory.dmp

          Filesize

          4KB

        • memory/2828-32-0x0000000001EB0000-0x0000000001F64000-memory.dmp

          Filesize

          720KB