Overview

overview

10

Static

static

cYNhXOc.dll

windows7_x64

10

cYNhXOc.dll

windows10_x64

10

Resubmissions

15-11-2023 12:50

231115-p3c9zacb5x 10

22-07-2020 17:01

200722-kpynvy9y5s 10

Analysis

  • max time kernel
    131s
  • max time network
    132s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    22-07-2020 17:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cYNhXOc.dll

  • Size

    395KB

  • MD5

    4aaf7ca556de0be48d9bb5bed405fa88

  • SHA1

    b85f9bf19e02f7756ee4aeb32c41d4b117a75045

  • SHA256

    de7da2ce5f2d7e5415bc3256cc5b7f97878ae9436497660b9add78829a8650cf

  • SHA512

    31911b68c382f04ca332c55274a31a20822b444f51a4ff407901deb686b035e209cf209ab997c03a40341de0ec868e83e701ae0950d577c7aac6f5f654e74c22

Score
10/10
trojanbotnetzloader

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Blacklisted process makes network request 3 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3008
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4028
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#1
          3⤵
          • Suspicious use of WriteProcessMemory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Suspicious use of SetThreadContext
          PID:2164
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Blacklisted process makes network request
        PID:2316

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2316-1-0x0000000002F40000-0x0000000002F6B000-memory.dmp

      Filesize

      172KB

      Download