Resubmissions

31-01-2024 21:42

240131-1ktpsadab6 10

24-01-2024 07:47

240124-jml92sdcd6 10

23-01-2024 11:54

240123-n25r6ahhfk 10

24-06-2020 13:36

200624-enc457kzrj 10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    24-06-2020 13:36

General

  • Target

    A004BC8B4F3DB1EF5A66579B9746B5B1.bin.dll

  • Size

    424KB

  • MD5

    a004bc8b4f3db1ef5a66579b9746b5b1

  • SHA1

    88a5fcebfd7a037a9ca9573772ac2334a61b25de

  • SHA256

    42bb5eae534eb2cea979c300b797a65febf291b28aea0b9d8bbea7d0a41bffa2

  • SHA512

    28aed111b2ecea90c2da03871f36272b8680d392c245fdf0e2f4d4454974a3a51d6744133cecfc2576bbc778742f9b824e8355026b53d029d13ff79bb2136f9b

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 35 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Blacklisted process makes network request 18 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Discovers systems in the same network 1 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\A004BC8B4F3DB1EF5A66579B9746B5B1.bin.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\A004BC8B4F3DB1EF5A66579B9746B5B1.bin.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      PID:3828
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious use of AdjustPrivilegeToken
        • Blacklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        PID:3720
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c ipconfig /all
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:352
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            5⤵
              PID:1624
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c net config workstation
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2416
            • C:\Windows\SysWOW64\net.exe
              net config workstation
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3884
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 config workstation
                6⤵
                  PID:1432
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c net view /all
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1924
              • C:\Windows\SysWOW64\net.exe
                net view /all
                5⤵
                • Discovers systems in the same network
                PID:1320
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c net view /all /domain
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2644
              • C:\Windows\SysWOW64\net.exe
                net view /all /domain
                5⤵
                • Discovers systems in the same network
                PID:3864

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3720-1-0x0000000002A80000-0x0000000002AAB000-memory.dmp

        Filesize

        172KB

      • memory/3720-79-0x0000000006654000-0x00000000067A0000-memory.dmp

        Filesize

        1.3MB