Analysis
- max time kernel
149s - max time network
133s - platform
windows10_x64 - resource
win10 - submitted
25/10/2020, 02:24
Static task
static1
Behavioral task
behavioral1
Sample
c909c534b06661fb51fe27c5752aa7eca1a240200d2ff9b2d49c7baf52f3ca16.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target c909c534b06661fb51fe27c5752aa7eca1a240200d2ff9b2d49c7baf52f3ca16.dll
- Size 579KB
- Sample201025-rl8b8dmf26
- SHA256 c909c534b06661fb51fe27c5752aa7eca1a240200d2ff9b2d49c7baf52f3ca16
- MD5 4fe27f904713fc19f81aae2897943002
- SHA1 c3f82ccb40edb637de19e3d1a042e9c3aea3ec75
- SHA512 5537c1f10df0e95efd0f971130fecc384f02d89137bf07951e546a528293c721821e60196a7668b22045de240f252c8dc4c02b51c06cdfa62cfee063026a1f50
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
zloader
Botnet
-
target1
Campaign
-
target1
C2
-
https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php
-
https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php
-
https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php
-
https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php
-
https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php
rc4.plain
rsa_pubkey.plain
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4920 created 2944 4920 rundll32.exe 57 - Blacklisted process makes network request 15 IoCs
flow pid Process 16 744 msiexec.exe 17 744 msiexec.exe 18 744 msiexec.exe 19 744 msiexec.exe 20 744 msiexec.exe 21 744 msiexec.exe 22 744 msiexec.exe 23 744 msiexec.exe 24 744 msiexec.exe 25 744 msiexec.exe 26 744 msiexec.exe 28 744 msiexec.exe 29 744 msiexec.exe 30 744 msiexec.exe 31 744 msiexec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4920 set thread context of 744 4920 rundll32.exe 78 - Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 4568 net.exe 4724 net.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4052 ipconfig.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4920 rundll32.exe 4920 rundll32.exe 744 msiexec.exe 744 msiexec.exe 744 msiexec.exe 744 msiexec.exe 744 msiexec.exe 744 msiexec.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 4920 rundll32.exe Token: SeSecurityPrivilege 744 msiexec.exe Token: SeSecurityPrivilege 744 msiexec.exe Token: SeIncreaseQuotaPrivilege 2096 WMIC.exe Token: SeSecurityPrivilege 2096 WMIC.exe Token: SeTakeOwnershipPrivilege 2096 WMIC.exe Token: SeLoadDriverPrivilege 2096 WMIC.exe Token: SeSystemProfilePrivilege 2096 WMIC.exe Token: SeSystemtimePrivilege 2096 WMIC.exe Token: SeProfSingleProcessPrivilege 2096 WMIC.exe Token: SeIncBasePriorityPrivilege 2096 WMIC.exe Token: SeCreatePagefilePrivilege 2096 WMIC.exe Token: SeBackupPrivilege 2096 WMIC.exe Token: SeRestorePrivilege 2096 WMIC.exe Token: SeShutdownPrivilege 2096 WMIC.exe Token: SeDebugPrivilege 2096 WMIC.exe Token: SeSystemEnvironmentPrivilege 2096 WMIC.exe Token: SeRemoteShutdownPrivilege 2096 WMIC.exe Token: SeUndockPrivilege 2096 WMIC.exe Token: SeManageVolumePrivilege 2096 WMIC.exe Token: 33 2096 WMIC.exe Token: 34 2096 WMIC.exe Token: 35 2096 WMIC.exe Token: 36 2096 WMIC.exe Token: SeIncreaseQuotaPrivilege 2096 WMIC.exe Token: SeSecurityPrivilege 2096 WMIC.exe Token: SeTakeOwnershipPrivilege 2096 WMIC.exe Token: SeLoadDriverPrivilege 2096 WMIC.exe Token: SeSystemProfilePrivilege 2096 WMIC.exe Token: SeSystemtimePrivilege 2096 WMIC.exe Token: SeProfSingleProcessPrivilege 2096 WMIC.exe Token: SeIncBasePriorityPrivilege 2096 WMIC.exe Token: SeCreatePagefilePrivilege 2096 WMIC.exe Token: SeBackupPrivilege 2096 WMIC.exe Token: SeRestorePrivilege 2096 WMIC.exe Token: SeShutdownPrivilege 2096 WMIC.exe Token: SeDebugPrivilege 2096 WMIC.exe Token: SeSystemEnvironmentPrivilege 2096 WMIC.exe Token: SeRemoteShutdownPrivilege 2096 WMIC.exe Token: SeUndockPrivilege 2096 WMIC.exe Token: SeManageVolumePrivilege 2096 WMIC.exe Token: 33 2096 WMIC.exe Token: 34 2096 WMIC.exe Token: 35 2096 WMIC.exe Token: 36 2096 WMIC.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4756 wrote to memory of 4920 4756 rundll32.exe 69 PID 4756 wrote to memory of 4920 4756 rundll32.exe 69 PID 4756 wrote to memory of 4920 4756 rundll32.exe 69 PID 4920 wrote to memory of 744 4920 rundll32.exe 78 PID 4920 wrote to memory of 744 4920 rundll32.exe 78 PID 4920 wrote to memory of 744 4920 rundll32.exe 78 PID 4920 wrote to memory of 744 4920 rundll32.exe 78 PID 4920 wrote to memory of 744 4920 rundll32.exe 78 PID 744 wrote to memory of 3244 744 msiexec.exe 79 PID 744 wrote to memory of 3244 744 msiexec.exe 79 PID 744 wrote to memory of 3244 744 msiexec.exe 79 PID 744 wrote to memory of 2096 744 msiexec.exe 80 PID 744 wrote to memory of 2096 744 msiexec.exe 80 PID 744 wrote to memory of 2096 744 msiexec.exe 80 PID 3244 wrote to memory of 4052 3244 cmd.exe 83 PID 3244 wrote to memory of 4052 3244 cmd.exe 83 PID 3244 wrote to memory of 4052 3244 cmd.exe 83 PID 744 wrote to memory of 1924 744 msiexec.exe 84 PID 744 wrote to memory of 1924 744 msiexec.exe 84 PID 744 wrote to memory of 1924 744 msiexec.exe 84 PID 1924 wrote to memory of 4496 1924 cmd.exe 86 PID 1924 wrote to memory of 4496 1924 cmd.exe 86 PID 1924 wrote to memory of 4496 1924 cmd.exe 86 PID 4496 wrote to memory of 4476 4496 net.exe 87 PID 4496 wrote to memory of 4476 4496 net.exe 87 PID 4496 wrote to memory of 4476 4496 net.exe 87 PID 744 wrote to memory of 4604 744 msiexec.exe 88 PID 744 wrote to memory of 4604 744 msiexec.exe 88 PID 744 wrote to memory of 4604 744 msiexec.exe 88 PID 4604 wrote to memory of 4568 4604 cmd.exe 90 PID 4604 wrote to memory of 4568 4604 cmd.exe 90 PID 4604 wrote to memory of 4568 4604 cmd.exe 90 PID 744 wrote to memory of 3100 744 msiexec.exe 91 PID 744 wrote to memory of 3100 744 msiexec.exe 91 PID 744 wrote to memory of 3100 744 msiexec.exe 91 PID 3100 wrote to memory of 4724 3100 cmd.exe 93 PID 3100 wrote to memory of 4724 3100 cmd.exe 93 PID 3100 wrote to memory of 4724 3100 cmd.exe 93
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2944
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c909c534b06661fb51fe27c5752aa7eca1a240200d2ff9b2d49c7baf52f3ca16.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c909c534b06661fb51fe27c5752aa7eca1a240200d2ff9b2d49c7baf52f3ca16.dll,#13⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
-
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ipconfig /all3⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:4052
-
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net config workstation3⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\net.exenet config workstation4⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 config workstation5⤵PID:4476
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all3⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\net.exenet view /all4⤵
- Discovers systems in the same network
PID:4568
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all /domain3⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\net.exenet view /all /domain4⤵
- Discovers systems in the same network
PID:4724
-
-
-