Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
28-07-2020 23:07
Static task
static1
Behavioral task
behavioral1
Sample
cYNhXOc.dll
Resource
win7v200722
General
-
Target
cYNhXOc.dll
-
Size
508KB
-
MD5
7bebb1b85a609733df0b3205406723bb
-
SHA1
384f07648c732cd9490b7d3bff41ce5a0911b138
-
SHA256
02846dbf25b333625a0720075fb47da62a946e5b0b4f9e9ba14cef514d576b37
-
SHA512
4147af9ed60d340218deb382374a015a3bb4cc4abc585e833e1a81ba21bf05f485e2a4cfc7b99223e9015ccda993c5ff19693ce7c00fb18701e66cd259422865
Malware Config
Extracted
zloader
july28
july28
https://vlcafxbdjtlvlcduwhga.com/web/post.php
https://softwareserviceupdater3.com/web/post.php
https://softwareserviceupdater4.com/web/post.php
2b4@jfhu#sd43fd!42d
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Discovers systems in the same network 1 TTPs 2 IoCs
-
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
rundll32.exerundll32.exemsiexec.execmd.execmd.exenet.execmd.execmd.exedescription pid process target process PID 648 wrote to memory of 724 648 rundll32.exe rundll32.exe PID 648 wrote to memory of 724 648 rundll32.exe rundll32.exe PID 648 wrote to memory of 724 648 rundll32.exe rundll32.exe PID 724 wrote to memory of 2784 724 rundll32.exe msiexec.exe PID 724 wrote to memory of 2784 724 rundll32.exe msiexec.exe PID 724 wrote to memory of 2784 724 rundll32.exe msiexec.exe PID 724 wrote to memory of 2784 724 rundll32.exe msiexec.exe PID 724 wrote to memory of 2784 724 rundll32.exe msiexec.exe PID 2784 wrote to memory of 3944 2784 msiexec.exe cmd.exe PID 2784 wrote to memory of 3944 2784 msiexec.exe cmd.exe PID 2784 wrote to memory of 3944 2784 msiexec.exe cmd.exe PID 3944 wrote to memory of 3932 3944 cmd.exe ipconfig.exe PID 3944 wrote to memory of 3932 3944 cmd.exe ipconfig.exe PID 3944 wrote to memory of 3932 3944 cmd.exe ipconfig.exe PID 2784 wrote to memory of 3180 2784 msiexec.exe cmd.exe PID 2784 wrote to memory of 3180 2784 msiexec.exe cmd.exe PID 2784 wrote to memory of 3180 2784 msiexec.exe cmd.exe PID 3180 wrote to memory of 1668 3180 cmd.exe net.exe PID 3180 wrote to memory of 1668 3180 cmd.exe net.exe PID 3180 wrote to memory of 1668 3180 cmd.exe net.exe PID 1668 wrote to memory of 3388 1668 net.exe net1.exe PID 1668 wrote to memory of 3388 1668 net.exe net1.exe PID 1668 wrote to memory of 3388 1668 net.exe net1.exe PID 2784 wrote to memory of 2708 2784 msiexec.exe cmd.exe PID 2784 wrote to memory of 2708 2784 msiexec.exe cmd.exe PID 2784 wrote to memory of 2708 2784 msiexec.exe cmd.exe PID 2708 wrote to memory of 516 2708 cmd.exe net.exe PID 2708 wrote to memory of 516 2708 cmd.exe net.exe PID 2708 wrote to memory of 516 2708 cmd.exe net.exe PID 2784 wrote to memory of 3348 2784 msiexec.exe cmd.exe PID 2784 wrote to memory of 3348 2784 msiexec.exe cmd.exe PID 2784 wrote to memory of 3348 2784 msiexec.exe cmd.exe PID 3348 wrote to memory of 4064 3348 cmd.exe net.exe PID 3348 wrote to memory of 4064 3348 cmd.exe net.exe PID 3348 wrote to memory of 4064 3348 cmd.exe net.exe -
Blacklisted process makes network request 16 IoCs
Processes:
msiexec.exeflow pid process 15 2784 msiexec.exe 16 2784 msiexec.exe 17 2784 msiexec.exe 18 2784 msiexec.exe 19 2784 msiexec.exe 20 2784 msiexec.exe 21 2784 msiexec.exe 22 2784 msiexec.exe 23 2784 msiexec.exe 24 2784 msiexec.exe 25 2784 msiexec.exe 26 2784 msiexec.exe 27 2784 msiexec.exe 28 2784 msiexec.exe 29 2784 msiexec.exe 30 2784 msiexec.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 724 created 3068 724 rundll32.exe Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 724 set thread context of 2784 724 rundll32.exe msiexec.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3932 ipconfig.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
rundll32.exemsiexec.exedescription pid process Token: SeDebugPrivilege 724 rundll32.exe Token: SeSecurityPrivilege 2784 msiexec.exe Token: SeSecurityPrivilege 2784 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exemsiexec.exepid process 724 rundll32.exe 724 rundll32.exe 2784 msiexec.exe 2784 msiexec.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3068
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cYNhXOc.dll,#13⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:724 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2784 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ipconfig /all3⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:3932 -
C:\Windows\SysWOW64\cmd.execmd.exe /c net config workstation3⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\net.exenet config workstation4⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 config workstation5⤵PID:3388
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all3⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\net.exenet view /all4⤵
- Discovers systems in the same network
PID:516 -
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all /domain3⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\net.exenet view /all /domain4⤵
- Discovers systems in the same network
PID:4064