Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 03:58
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_a09cf72b0627bde15b78311dc1927df557b0e9606d4c2ce86bafc158bbbf6fee.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_a09cf72b0627bde15b78311dc1927df557b0e9606d4c2ce86bafc158bbbf6fee.dll
-
Size
625KB
-
MD5
12cd42daff4d124b5ad93b5318cc5336
-
SHA1
d3d7c472819567da0fa18ed2cbc50a98e6c265f4
-
SHA256
a09cf72b0627bde15b78311dc1927df557b0e9606d4c2ce86bafc158bbbf6fee
-
SHA512
9a3715643e925cb28f6971ee62dfdc45dd7086544dfd6ee2e4072c7a039d8034abb77e2b79fb05e277e4fb0b4b829b462c414b158c2c630d16aa8a9e434737d4
-
SSDEEP
12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Zi:+w1lEKOpuYxiwkkgjAN8Zi
Malware Config
Extracted
gozi
Extracted
gozi
999
config.edge.skype.com
146.70.35.138
146.70.35.142
-
base_path
/phpadmin/
-
build
250227
-
exe_type
loader
-
extension
.src
-
server_id
50
Signatures
-
Gozi family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1728 wrote to memory of 956 1728 rundll32.exe 31 PID 1728 wrote to memory of 956 1728 rundll32.exe 31 PID 1728 wrote to memory of 956 1728 rundll32.exe 31 PID 1728 wrote to memory of 956 1728 rundll32.exe 31 PID 1728 wrote to memory of 956 1728 rundll32.exe 31 PID 1728 wrote to memory of 956 1728 rundll32.exe 31 PID 1728 wrote to memory of 956 1728 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a09cf72b0627bde15b78311dc1927df557b0e9606d4c2ce86bafc158bbbf6fee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a09cf72b0627bde15b78311dc1927df557b0e9606d4c2ce86bafc158bbbf6fee.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:956
-