Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 12:40
Static task
static1
Behavioral task
behavioral1
Sample
900a62f1d821af1da2b5235e651057b062a9fd3c74002ac38218038f7e6b4ea4.dll
Resource
win7-20240729-en
General
-
Target
900a62f1d821af1da2b5235e651057b062a9fd3c74002ac38218038f7e6b4ea4.dll
-
Size
937KB
-
MD5
b8bb6c8467092ef368e68446e68415ec
-
SHA1
9d0588bd231af048ba576216a158ad261a41d242
-
SHA256
900a62f1d821af1da2b5235e651057b062a9fd3c74002ac38218038f7e6b4ea4
-
SHA512
d5b7289a3c99b00830553a6b81afc252d760b7e1bdf9c54a44795a2b2bf9a86f5d1c04f6e9a4323991c06e45173f8854b09c9b1eec02c43d5e9454e6b044b9ce
-
SSDEEP
24576:HQfpzjXPgfM8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgQJV4OaIRj150CpNiLi
Malware Config
Extracted
gozi
Extracted
gozi
4500
app3.maintorna.com
chat.billionady.com
app5.folion.xyz
wer.defone.click
-
build
250188
-
exe_type
loader
-
server_id
580
Signatures
-
Gozi family
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2916 wrote to memory of 2120 2916 rundll32.exe 31 PID 2916 wrote to memory of 2120 2916 rundll32.exe 31 PID 2916 wrote to memory of 2120 2916 rundll32.exe 31 PID 2916 wrote to memory of 2120 2916 rundll32.exe 31 PID 2916 wrote to memory of 2544 2916 rundll32.exe 33 PID 2916 wrote to memory of 2544 2916 rundll32.exe 33 PID 2916 wrote to memory of 2544 2916 rundll32.exe 33 PID 2916 wrote to memory of 2544 2916 rundll32.exe 33
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\900a62f1d821af1da2b5235e651057b062a9fd3c74002ac38218038f7e6b4ea4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\900a62f1d821af1da2b5235e651057b062a9fd3c74002ac38218038f7e6b4ea4.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Island3⤵
- System Location Discovery: System Language Discovery
PID:2120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd Matter m3⤵
- System Location Discovery: System Language Discovery
PID:2544
-
-