Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 08:22
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_761f7bdaf8d39788f4ac5facc3448eca61e7ec6f3c85ae3eb18c75d2b269a451.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_761f7bdaf8d39788f4ac5facc3448eca61e7ec6f3c85ae3eb18c75d2b269a451.dll
-
Size
624KB
-
MD5
2cfef947b102dd0453c8f2ae88e677d0
-
SHA1
4443138f1f352a9164d137182f95ec1b6f10bea6
-
SHA256
761f7bdaf8d39788f4ac5facc3448eca61e7ec6f3c85ae3eb18c75d2b269a451
-
SHA512
6a46a6ba9f3e11edeb09988f4f26ba4f25e9f7848742a838c2799ceac2bb49d1ba157007c25bbe854d7700989ba83ef43994df4a65e4ecb60d177c0c623a5a23
-
SSDEEP
12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Z6:+w1lEKOpuYxiwkkgjAN8Z6
Malware Config
Extracted
gozi
Extracted
gozi
999
config.edge.skype.com
146.70.35.138
146.70.35.142
-
base_path
/phpadmin/
-
build
250227
-
exe_type
loader
-
extension
.src
-
server_id
50
Signatures
-
Gozi family
-
Blocklisted process makes network request 4 IoCs
flow pid Process 17 4928 rundll32.exe 23 4928 rundll32.exe 45 4928 rundll32.exe 46 4928 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2140 wrote to memory of 4928 2140 rundll32.exe 83 PID 2140 wrote to memory of 4928 2140 rundll32.exe 83 PID 2140 wrote to memory of 4928 2140 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_761f7bdaf8d39788f4ac5facc3448eca61e7ec6f3c85ae3eb18c75d2b269a451.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_761f7bdaf8d39788f4ac5facc3448eca61e7ec6f3c85ae3eb18c75d2b269a451.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:4928
-