Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    14-08-2020 16:39

General

  • Target

    3cf5f3676b792e44749030150a0a0f55.dll

  • Size

    504KB

  • MD5

    3cf5f3676b792e44749030150a0a0f55

  • SHA1

    8af704ed880f4a85dc33779a716187f2c3ba8e99

  • SHA256

    13509b3f6aeacb569938cc1baa474beac1c0e6d1ce222ca681d9d463889babac

  • SHA512

    b103583c441d6012969f176603896808eaf4d114be09c992486b0fef7e2c8abaeb899f15c694189317e3b67fa1c4066bfab79d000244ec6ea2f8989f2666b53b

Score
10/10

Malware Config

Extracted

Family

zloader

Botnet

nut

Campaign

14/08

C2

https://girldowcahohorme.tk/wp-parsing.php

http://thegamegolfmagazine.com/wp-parsing.php

http://truvaluconsulting.com/wp-parsing.php

https://blog2.textbookrush.com/wp-parsing.php

https://curiosidadez.com.br/wp-parsing.php

https://nonchothetohear.cf/wp-parsing.php

https://sicupira8.com.br/wp-parsing.php

https://titaniumgamers.com/wp-parsing.php

rc4.plain
rsa_pubkey.plain

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess ⋅ 1 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    PID:1256
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cf5f3676b792e44749030150a0a0f55.dll,#1
      Suspicious use of WriteProcessMemory
      PID:1612
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cf5f3676b792e44749030150a0a0f55.dll,#1
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:364
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe
      Suspicious use of AdjustPrivilegeToken
      PID:1964

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/364-0-0x0000000000000000-mapping.dmp
                          • memory/1964-1-0x00000000000D0000-0x00000000000FC000-memory.dmp
                          • memory/1964-2-0x0000000000100000-0x0000000000101000-memory.dmp
                          • memory/1964-3-0x00000000000D0000-0x00000000000FC000-memory.dmp
                          • memory/1964-4-0x0000000000000000-mapping.dmp