Analysis
- max time kernel
150s - max time network
146s - platform
windows10_x64 - resource
win10 - submitted
07/07/2020, 06:39
Static task
static1
Behavioral task
behavioral1
Sample
Zloader Dll.dll
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target Zloader Dll.dll
- Size 433KB
- Sample200707-le2pcbrm36
- SHA256 3bf8fbdad095013493d1b90f5c82880dc57145dfbb54fdf225ded88ba6b1618b
- MD5 37952c2ae6b0dda5efa44196bc338cf1
- SHA1 cb466d91a60f1a9fdcea54cd265562cf139a48ee
- SHA512 a10448ec63bc221fe14bc5a25f52fda2f212bf1f7619f8979a96919ab69c495674894b78a04037f5e993b3408f1d00364e308627817a933fb11aff37d4003079
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3544 wrote to memory of 3708 3544 rundll32.exe 67 PID 3544 wrote to memory of 3708 3544 rundll32.exe 67 PID 3544 wrote to memory of 3708 3544 rundll32.exe 67 PID 3708 wrote to memory of 980 3708 rundll32.exe 74 PID 3708 wrote to memory of 980 3708 rundll32.exe 74 PID 3708 wrote to memory of 980 3708 rundll32.exe 74 PID 3708 wrote to memory of 980 3708 rundll32.exe 74 PID 3708 wrote to memory of 980 3708 rundll32.exe 74 - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3708 rundll32.exe Token: SeSecurityPrivilege 980 msiexec.exe Token: SeSecurityPrivilege 980 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3708 rundll32.exe 3708 rundll32.exe - Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3708 created 2972 3708 rundll32.exe 56 - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3708 set thread context of 980 3708 rundll32.exe 74 - Blacklisted process makes network request 37 IoCs
flow pid Process 11 980 msiexec.exe 12 980 msiexec.exe 13 980 msiexec.exe 14 980 msiexec.exe 15 980 msiexec.exe 16 980 msiexec.exe 21 980 msiexec.exe 22 980 msiexec.exe 23 980 msiexec.exe 24 980 msiexec.exe 25 980 msiexec.exe 26 980 msiexec.exe 28 980 msiexec.exe 29 980 msiexec.exe 30 980 msiexec.exe 31 980 msiexec.exe 32 980 msiexec.exe 33 980 msiexec.exe 35 980 msiexec.exe 37 980 msiexec.exe 39 980 msiexec.exe 41 980 msiexec.exe 43 980 msiexec.exe 44 980 msiexec.exe 45 980 msiexec.exe 46 980 msiexec.exe 47 980 msiexec.exe 48 980 msiexec.exe 49 980 msiexec.exe 50 980 msiexec.exe 51 980 msiexec.exe 52 980 msiexec.exe 53 980 msiexec.exe 55 980 msiexec.exe 56 980 msiexec.exe 57 980 msiexec.exe 58 980 msiexec.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2972
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Zloader Dll.dll",#12⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Zloader Dll.dll",#13⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
PID:3708
-
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
PID:980
-