Overview

overview

10

Static

static

3599f01a61...db.dll

windows7_x64

10

3599f01a61...db.dll

windows10_x64

10

Analysis

  • max time kernel
    135s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    04-07-2020 08:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3599f01a6162db10307b75c7132c06db.dll

  • Size

    634KB

  • MD5

    3599f01a6162db10307b75c7132c06db

  • SHA1

    363a23608cccc5d39393c51eb9570e624aef8558

  • SHA256

    3326d4607b164078735ee55313992c18e83e6b87b75faf350b8c61a99eb2b659

  • SHA512

    c63566de21e4aba265ae80a51f56a9622e4bdac40430b477d269304f6793f062742728ebf4ba9457cf48c3d9bd654b81d48fbec7f1b304392f51d14efa1ebafd

Score
10/10
trojanbotnetzloader

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • ServiceHost packer 1 IoCs

    Detects ServiceHost packer used for .NET malware

  • Blacklisted process makes network request 17 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2984
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\3599f01a6162db10307b75c7132c06db.dll,#1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\3599f01a6162db10307b75c7132c06db.dll,#1
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4008
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 596
            4⤵
            • Suspicious use of NtCreateProcessExOtherParentProcess
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2248
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        2⤵
        • Blacklisted process makes network request
        • Suspicious use of AdjustPrivilegeToken
        PID:8

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/8-1-0x0000000002DC0000-0x0000000002DEC000-memory.dmp
      Filesize

      176KB

      Download
    • memory/8-2-0x0000000000000000-mapping.dmp
      Download
    • memory/2248-3-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2248-5-0x00000000053D0000-0x00000000053D1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4008-0-0x0000000000000000-mapping.dmp
      Download
    • memory/4008-4-0x0000000000000000-mapping.dmp
      Download