Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    09-08-2020 13:28

General

  • Target

    ce9d8545eb14f98f81526457b784ada2e37057dae2d74f625e47b4ed10549397.dll

  • Size

    155KB

  • MD5

    cd57e5511bb7c0390eb83b772c84de65

  • SHA1

    5c6e3c717dfab4b0eb3ddfa6f3062355823f2088

  • SHA256

    ce9d8545eb14f98f81526457b784ada2e37057dae2d74f625e47b4ed10549397

  • SHA512

    036e4ded92ed1ee28ab79dfd19116c7b86fac5c3a9ca5cc7f92f4cbd5b4a4771a6dc01af93a5b65d53a0367dd684eb52bb81a51621baa56e84cbd4007406d362

Malware Config

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Blacklisted process makes network request 18 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Modifies service 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Discovers systems in the same network 1 TTPs 2 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9d8545eb14f98f81526457b784ada2e37057dae2d74f625e47b4ed10549397.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce9d8545eb14f98f81526457b784ada2e37057dae2d74f625e47b4ed10549397.dll,#1
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        3⤵
        • Blacklisted process makes network request
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1696
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c ipconfig /all
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2000
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            5⤵
            • Modifies service
            • Gathers network information
            PID:824
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c net config workstation
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1060
          • C:\Windows\SysWOW64\net.exe
            net config workstation
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1456
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 config workstation
              6⤵
                PID:788
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c net view /all
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:992
            • C:\Windows\SysWOW64\net.exe
              net view /all
              5⤵
              • Discovers systems in the same network
              PID:1576
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c net view /all /domain
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1748
            • C:\Windows\SysWOW64\net.exe
              net view /all /domain
              5⤵
              • Discovers systems in the same network
              PID:1548

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Command-Line Interface

    1
    T1059

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Modify Existing Service

    1
    T1031

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Remote System Discovery

    1
    T1018

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/788-10-0x0000000000000000-mapping.dmp
    • memory/824-7-0x0000000000000000-mapping.dmp
    • memory/992-11-0x0000000000000000-mapping.dmp
    • memory/1056-0-0x0000000000000000-mapping.dmp
    • memory/1060-8-0x0000000000000000-mapping.dmp
    • memory/1420-5-0x000007FEF7B80000-0x000007FEF7DFA000-memory.dmp
      Filesize

      2MB

    • memory/1456-9-0x0000000000000000-mapping.dmp
    • memory/1548-14-0x0000000000000000-mapping.dmp
    • memory/1576-12-0x0000000000000000-mapping.dmp
    • memory/1696-3-0x0000000000090000-0x00000000000BC000-memory.dmp
      Filesize

      176KB

    • memory/1696-4-0x0000000000000000-mapping.dmp
    • memory/1696-2-0x00000000000C0000-0x00000000000C1000-memory.dmp
      Filesize

      4KB

    • memory/1696-1-0x0000000000090000-0x00000000000BC000-memory.dmp
      Filesize

      176KB

    • memory/1748-13-0x0000000000000000-mapping.dmp
    • memory/2000-6-0x0000000000000000-mapping.dmp