Analysis

  • max time kernel
    87s
  • max time network
    10s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    27-08-2020 20:33

General

  • Target

    SecuriteInfo.com.Generic.mg.22c1b894002c6ffd.12583.dll

  • Size

    723KB

  • MD5

    22c1b894002c6ffd1fdc2a75b48ddcda

  • SHA1

    5037543f108882d6a0d5b1907d125d40e4126e32

  • SHA256

    c91229d90c423cd5b5bf870cec714e5c956058c62f4b2036607d44f1767c50d2

  • SHA512

    67fe107a5bf13fa041eed46c4477ced5fd1af826cd6fc7e5b0661f3690d1a1eeeb69973ef9ccb50c13bc38740711ad0070daaa4b23ef49c9f28c164a881c4a67

Score
10/10

Malware Config

Extracted

Family

zloader

Botnet

bat1k3

Campaign

bat1k3

C2

http://as9897234135.xyz/LKhwojehDgwegSDG/gateJKjdsh.php

http://as9897234135.org/LKhwojehDgwegSDG/gateJKjdsh.php

http://as9897234135.net/LKhwojehDgwegSDG/gateJKjdsh.php

http://as9897234135.in/LKhwojehDgwegSDG/gateJKjdsh.php

http://as9897234135.com/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain
rsa_pubkey.plain

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1188
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.22c1b894002c6ffd.12583.dll,#1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.22c1b894002c6ffd.12583.dll,#1
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:740
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1524

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/740-0-0x0000000000000000-mapping.dmp
    • memory/1524-1-0x0000000000090000-0x00000000000BD000-memory.dmp
      Filesize

      180KB

    • memory/1524-2-0x00000000000C0000-0x00000000000C1000-memory.dmp
      Filesize

      4KB

    • memory/1524-3-0x0000000000090000-0x00000000000BD000-memory.dmp
      Filesize

      180KB

    • memory/1524-4-0x0000000000000000-mapping.dmp