Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 08:52
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_836d7a98a53c1235b0c3337775ddc22e3285f1cbc69935ac9548aa14f98aa0a2.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_836d7a98a53c1235b0c3337775ddc22e3285f1cbc69935ac9548aa14f98aa0a2.dll
-
Size
624KB
-
MD5
2c73f98434c74681cf3eebe9536d9c7d
-
SHA1
1a05c028ff9f6233d2330d0a9bac24a2f46fc1c0
-
SHA256
836d7a98a53c1235b0c3337775ddc22e3285f1cbc69935ac9548aa14f98aa0a2
-
SHA512
e76f30495e552916d1f5be265184f2f3cab646dc6c63319815ba80eba8096c1479cd22fd5d8130847624470157d5e0c2814ad9293f2ac347852e04fd22a0d299
-
SSDEEP
12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZH:+w1lEKOpuYxiwkkgjAN8ZH
Malware Config
Extracted
gozi
Extracted
gozi
999
config.edge.skype.com
146.70.35.138
146.70.35.142
-
base_path
/phpadmin/
-
build
250227
-
exe_type
loader
-
extension
.src
-
server_id
50
Signatures
-
Gozi family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2736 2664 rundll32.exe 31 PID 2664 wrote to memory of 2736 2664 rundll32.exe 31 PID 2664 wrote to memory of 2736 2664 rundll32.exe 31 PID 2664 wrote to memory of 2736 2664 rundll32.exe 31 PID 2664 wrote to memory of 2736 2664 rundll32.exe 31 PID 2664 wrote to memory of 2736 2664 rundll32.exe 31 PID 2664 wrote to memory of 2736 2664 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_836d7a98a53c1235b0c3337775ddc22e3285f1cbc69935ac9548aa14f98aa0a2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_836d7a98a53c1235b0c3337775ddc22e3285f1cbc69935ac9548aa14f98aa0a2.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2736
-